{ "swagger": "2.0", "info": { "title": "multithreatscanapi", "description": "Scan text, files, and URLs for multiple threat types in a single API call.", "version": "v1" }, "paths": { "/multi-threat-scan/text": { "post": { "tags": [ "MultiThreatScan" ], "summary": "Scan text for multiple threat types including viruses, phishing, spam, DLP, and policy violations in a single API call.", "consumes": [ "application/json", "text/json", "application/*+json" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "body", "name": "body", "description": "Text scan request with content and scan configuration", "schema": { "$ref": "#/definitions/MultiThreatTextRequest" } } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatTextResponse" } } } } }, "/multi-threat-scan/file": { "post": { "tags": [ "MultiThreatScan" ], "summary": "Scan a file for multiple threat types including viruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations in a single API call.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "formData", "name": "inputFile", "description": "The file to scan", "required": true, "type": "file" }, { "in": "formData", "name": "config", "description": "Optional JSON scan configuration", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatFileResponse" } } } } }, "/multi-threat-scan/url": { "post": { "tags": [ "MultiThreatScan" ], "summary": "Scan a URL for multiple threat types including viruses, phishing, and policy violations in a single API call. Optionally download and scan the file at the URL.", "consumes": [ "application/json", "text/json", "application/*+json" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "body", "name": "body", "description": "URL scan request with URL and scan configuration", "schema": { "$ref": "#/definitions/MultiThreatUrlRequest" } } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatUrlResponse" } } } } }, "/multi-threat-scan/cloud-storage/azure-blob": { "post": { "tags": [ "MultiThreatScanCloudStorage" ], "summary": "Scan an Azure Blob for multiple threat types including viruses, NSFW, AI-generated\r\ncontent, fraud, phishing, spam, DLP, and policy violations in a single API call. The\r\nblob is downloaded from Azure Blob Storage and scanned in memory; it is never persisted.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "connectionString", "description": "Connection string for the Azure Blob Storage Account; you can get this connection string from the Access Keys tab of the Storage Account blade in the Azure Portal.", "type": "string" }, { "in": "header", "name": "containerName", "description": "Name of the Blob container within the Azure Blob Storage account", "type": "string" }, { "in": "header", "name": "blobPath", "description": "Path to the blob within the container, such as 'hello.pdf' or '/folder/subfolder/world.pdf'. If the blob path contains Unicode characters, you must base64 encode the blob path and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatCloudStorageResponse" } } } } }, "/multi-threat-scan/cloud-storage/aws-s3": { "post": { "tags": [ "MultiThreatScanCloudStorage" ], "summary": "Scan an AWS S3 file for multiple threat types including viruses, NSFW, AI-generated\r\ncontent, fraud, phishing, spam, DLP, and policy violations in a single API call. The\r\nobject is downloaded from the S3 bucket and scanned in memory; it is never persisted.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "accessKey", "description": "AWS S3 access key for the S3 bucket; you can get this from My Security Credentials in the AWS console", "type": "string" }, { "in": "header", "name": "secretKey", "description": "AWS S3 secret key for the S3 bucket; you can get this from My Security Credentials in the AWS console", "type": "string" }, { "in": "header", "name": "bucketRegion", "description": "Name of the region of the S3 bucket, such as 'US-East-1'", "type": "string" }, { "in": "header", "name": "bucketName", "description": "Name of the S3 bucket", "type": "string" }, { "in": "header", "name": "keyName", "description": "Key name (also called file name) of the file in S3 that you wish to scan. If the key name contains Unicode characters, you must base64 encode the key name and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "header", "name": "roleArn", "description": "Optional: Role ARN for STS Credential-based access. This is for advanced access using the Security Token Service and is not required. If the roleArn contains Unicode characters, you must base64 encode it and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatCloudStorageResponse" } } } } }, "/multi-threat-scan/cloud-storage/gcp-storage": { "post": { "tags": [ "MultiThreatScanCloudStorage" ], "summary": "Scan a Google Cloud Platform (GCP) Storage file for multiple threat types including\r\nviruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations\r\nin a single API call. The object is downloaded from Google Cloud Storage and scanned in\r\nmemory; it is never persisted.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "bucketName", "description": "Name of the bucket in Google Cloud Storage", "type": "string" }, { "in": "header", "name": "objectName", "description": "Name of the object or file in Google Cloud Storage. If the object name contains Unicode characters, you must base64 encode the object name and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "jsonCredentialFile", "type": "file" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatCloudStorageResponse" } } } } }, "/multi-threat-scan/cloud-storage/sharepoint-online": { "post": { "tags": [ "MultiThreatScanCloudStorage" ], "summary": "Scan a SharePoint Online Site Drive file for multiple threat types including viruses,\r\nNSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations in a\r\nsingle API call. The file is downloaded from the SharePoint Online Site Drive and\r\nscanned in memory; it is never persisted.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "clientID", "description": "Client ID access credentials; you can get the Client ID from the App Registrations tab of the Azure Active Directory portal.", "type": "string" }, { "in": "header", "name": "clientSecret", "description": "Client Secret access credentials; you can get the Client Secret from the Certificates and Secrets tab of your App Registration in the Azure Active Directory portal.", "type": "string" }, { "in": "header", "name": "sharepointDomainName", "description": "SharePoint Online domain name, such as mydomain.sharepoint.com", "type": "string" }, { "in": "header", "name": "siteID", "description": "Site ID (GUID) of the SharePoint site you wish to retrieve the file from", "type": "string" }, { "in": "header", "name": "tenantID", "description": "Optional; Tenant ID of your Azure Active Directory", "type": "string" }, { "in": "header", "name": "filePath", "description": "Path to the file within the drive, such as 'hello.pdf' or '/folder/subfolder/world.pdf'. If the file path contains Unicode characters, you must base64 encode the file path and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'. Provide either filePath or itemID.", "type": "string" }, { "in": "header", "name": "itemID", "description": "SharePoint itemID, such as a DriveItem Id. Provide either filePath or itemID.", "type": "string" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/MultiThreatCloudStorageResponse" } } } } }, "/multi-threat-scan/batch-job/cloud-storage/azure-blob": { "post": { "tags": [ "MultiThreatScanTaskBatchJob" ], "summary": "Begin an asynchronous batch job to scan an Azure Blob for multiple threat types including\r\nviruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations in a\r\nsingle API call. Returns an AsyncJobID immediately; use the batch job status API to retrieve\r\nthe result once the job completes.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "connectionString", "description": "Connection string for the Azure Blob Storage Account; you can get this connection string from the Access Keys tab of the Storage Account blade in the Azure Portal.", "type": "string" }, { "in": "header", "name": "containerName", "description": "Name of the Blob container within the Azure Blob Storage account", "type": "string" }, { "in": "header", "name": "blobPath", "description": "Path to the blob within the container, such as 'hello.pdf' or '/folder/subfolder/world.pdf'. If the blob path contains Unicode characters, you must base64 encode the blob path and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/BatchJobCreateResult" } } } } }, "/multi-threat-scan/batch-job/cloud-storage/aws-s3": { "post": { "tags": [ "MultiThreatScanTaskBatchJob" ], "summary": "Begin an asynchronous batch job to scan an AWS S3 file for multiple threat types including\r\nviruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations in a\r\nsingle API call. Returns an AsyncJobID immediately; use the batch job status API to retrieve\r\nthe result once the job completes.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "accessKey", "description": "AWS S3 access key for the S3 bucket; you can get this from My Security Credentials in the AWS console", "type": "string" }, { "in": "header", "name": "secretKey", "description": "AWS S3 secret key for the S3 bucket; you can get this from My Security Credentials in the AWS console", "type": "string" }, { "in": "header", "name": "bucketRegion", "description": "Name of the region of the S3 bucket, such as 'US-East-1'", "type": "string" }, { "in": "header", "name": "bucketName", "description": "Name of the S3 bucket", "type": "string" }, { "in": "header", "name": "keyName", "description": "Key name (also called file name) of the file in S3 that you wish to scan. If the key name contains Unicode characters, you must base64 encode the key name and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "header", "name": "roleArn", "description": "Optional: Role ARN for STS Credential-based access. This is for advanced access using the Security Token Service and is not required. If the roleArn contains Unicode characters, you must base64 encode it and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/BatchJobCreateResult" } } } } }, "/multi-threat-scan/batch-job/cloud-storage/gcp-storage": { "post": { "tags": [ "MultiThreatScanTaskBatchJob" ], "summary": "Begin an asynchronous batch job to scan a Google Cloud Platform (GCP) Storage file for multiple\r\nthreat types including viruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy\r\nviolations in a single API call. Returns an AsyncJobID immediately; use the batch job status API\r\nto retrieve the result once the job completes.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "header", "name": "bucketName", "description": "Name of the bucket in Google Cloud Storage", "type": "string" }, { "in": "header", "name": "objectName", "description": "Name of the object or file in Google Cloud Storage. If the object name contains Unicode characters, you must base64 encode the object name and prepend it with 'base64:', such as: 'base64:6ZWV6ZWV6ZWV6ZWV6ZWV6ZWV'.", "type": "string" }, { "in": "formData", "name": "jsonCredentialFile", "type": "file" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/BatchJobCreateResult" } } } } }, "/multi-threat-scan/batch-job/file": { "post": { "tags": [ "MultiThreatScanTaskBatchJob" ], "summary": "Begin an asynchronous batch job to scan an uploaded file for multiple threat types including\r\nviruses, NSFW, AI-generated content, fraud, phishing, spam, DLP, and policy violations in a\r\nsingle API call. Returns an AsyncJobID immediately; use the batch job status API to retrieve\r\nthe result once the job completes.", "consumes": [ "multipart/form-data" ], "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "formData", "name": "inputFile", "type": "file" }, { "in": "formData", "name": "config", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/BatchJobCreateResult" } } } } }, "/multi-threat-scan/batch-job/status": { "get": { "tags": [ "MultiThreatScanTaskBatchJob" ], "summary": "Get the status and result of a multi-threat batch scan job. While the job is running this\r\nreturns STARTED; once finished it returns COMPLETED along with the full multi-threat scan\r\nresult, or FAILED (with an ErrorMessage) if the job terminated with an unhandled error.", "produces": [ "text/plain", "application/json", "text/json" ], "parameters": [ { "in": "query", "name": "AsyncJobID", "description": "Job ID of the async batch job (the AsyncJobID returned when the job was created)", "type": "string" } ], "responses": { "200": { "description": "OK", "schema": { "$ref": "#/definitions/BatchJobStatusResult" } } } } } }, "definitions": { "AdvancedVirusScanSettings": { "description": "Advanced Virus Scan options for URL scanning (Advanced mode). Same semantics as the\r\nfile endpoint's VirusScan settings.", "type": "object", "properties": { "AllowExecutables": { "description": "Allow executable files", "type": "boolean", "example": false }, "AllowInvalidFiles": { "description": "Allow invalid files", "type": "boolean", "example": false }, "AllowScripts": { "description": "Allow script content. Defaults to true for URL scans (web pages routinely contain script tags); set false to flag script content.", "type": "boolean", "example": true }, "AllowPasswordProtectedFiles": { "description": "Allow password-protected files", "type": "boolean", "example": false }, "AllowMacros": { "description": "Allow files containing macros", "type": "boolean", "example": false }, "AllowXmlExternalEntities": { "description": "Allow XML external entities", "type": "boolean", "example": false }, "AllowInsecureDeserialization": { "description": "Allow insecure deserialization", "type": "boolean", "example": false }, "AllowHtml": { "description": "Allow HTML content", "type": "boolean", "example": false }, "AllowUnsafeArchives": { "description": "Allow unsafe archives", "type": "boolean", "example": false }, "AllowOleEmbeddedObject": { "description": "Allow OLE embedded objects", "type": "boolean", "example": false }, "AllowUnwantedAction": { "description": "Allow unwanted actions", "type": "boolean", "example": false }, "AllowAuthenticodeSignedExecutables": { "description": "Allow an executable that carries an Authenticode signature meeting MinimumAuthenticodeSigningLevel, even when AllowExecutables is false. Default false. PE files (.exe/.dll/.sys) only.", "type": "boolean", "example": false }, "MinimumAuthenticodeSigningLevel": { "description": "Minimum Authenticode signing level an executable must meet to be allowed by AllowAuthenticodeSignedExecutables. Currently only \"Signed\" is supported.", "type": "string", "example": "Signed" }, "RestrictFileTypes": { "description": "Restrict to specific file types (comma-separated extensions)", "type": "string", "example": ".pdf,.docx,.png" }, "Options": { "description": "Comma-separated scan options", "type": "string" } }, "additionalProperties": false }, "AiContentDetectionConfig": { "description": "AI-generated content detection configuration", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable AI content detection", "type": "boolean", "example": true } }, "additionalProperties": false }, "AiContentDetectionResult": { "description": "AI content detection result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no AI-generated content was detected", "type": "boolean" }, "ContainsAiGeneratedContent": { "description": "Content appears to be AI-generated", "type": "boolean" }, "AiConfidenceLevel": { "format": "double", "description": "Confidence level of AI content detection (0.0 to 1.0)", "type": "number" }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" }, "Verdict": { "description": "Categorical assessment of whether the file appears AI-generated based on its\r\nembedded metadata. One of: NoDeterministicAiMetadataFound, VerifiedAiGenerated,\r\nVerifiedAiEditedOrComposite, LikelyAiGenerated, LikelyAiEditedOrComposite,\r\nPossibleAiGenerated, ConflictingSignals, MetadataUnavailableOrUnreadable,\r\nUnsupportedFileType.", "type": "string" }, "Provider": { "description": "AI provider name (for example, \"OpenAI\", \"Adobe\", \"Google\", \"Microsoft\").\r\nEmpty when the metadata does not identify a provider.", "type": "string" }, "Generator": { "description": "AI tool or product name (for example, \"ChatGPT\", \"Adobe Firefly\", \"Stable\r\nDiffusion\"). Empty when the metadata does not identify a specific tool.", "type": "string" }, "Warnings": { "description": "Non-fatal warnings produced during analysis, intended for diagnostic display.\r\nEmpty when no warnings were produced.", "type": "array", "items": { "type": "string" } }, "DetectedFileType": { "description": "File type detected from the file's content (for example, \"jpeg\", \"png\", \"pdf\").\r\nMay differ from the file's name extension when the content was misnamed.", "type": "string" } }, "additionalProperties": false }, "ArchiveEntryScanResult": { "description": "Scan result for one member of an archive", "type": "object", "properties": { "FileName": { "description": "Path of the member within the archive.", "type": "string", "example": "folder/report.pdf" }, "FileSize": { "format": "int64", "description": "Uncompressed size of the member in bytes.", "type": "integer" }, "Skipped": { "description": "True if this member was not scanned (e.g. a directory entry, an encrypted entry, or an extraction failure).", "type": "boolean" }, "SkipReason": { "description": "Reason the member was skipped, if applicable.", "type": "string" }, "Result": { "$ref": "#/definitions/MultiThreatFileResponse" } }, "additionalProperties": false }, "BatchJobCreateResult": { "description": "Result of creating a multi-threat batch scan job", "type": "object", "properties": { "Successful": { "description": "True if successful, false otherwise", "type": "boolean", "example": true }, "AsyncJobID": { "description": "When creating a job, an Async Job ID is returned. Use the Get Batch Job Status API to check on the status of this job using the AsyncJobID and get the result when it finishes.", "type": "string" } }, "additionalProperties": false }, "BatchJobStatusResult": { "description": "Status and result of a multi-threat batch scan job", "type": "object", "properties": { "Successful": { "description": "True if the operation to check the status of the job was successful, false otherwise", "type": "boolean", "example": true }, "AsyncJobStatus": { "description": "Status of the batch job. Possible states are STARTED, COMPLETED, and FAILED (the job terminated with an unhandled error; see ErrorMessage).", "type": "string", "example": "COMPLETED" }, "AsyncJobID": { "description": "Job ID of the async batch job", "type": "string" }, "Result": { "$ref": "#/definitions/MultiThreatCloudStorageResponse" }, "JobDuration": { "description": "Duration of a completed job", "type": "string", "example": "00:01:23.4560000" }, "ErrorMessage": { "description": "Error message (if any)", "type": "string" } }, "additionalProperties": false }, "ContentScanningConfig": { "description": "Configuration for downloading and scanning the file at a URL", "type": "object", "properties": { "Enabled": { "description": "Enable content scanning", "type": "boolean", "example": false }, "DownloadAndScan": { "description": "Download and scan the file at the URL", "type": "boolean", "example": true }, "NsfwDetection": { "$ref": "#/definitions/NsfwDetectionConfig" }, "AiContentDetection": { "$ref": "#/definitions/AiContentDetectionConfig" }, "FraudDetection": { "$ref": "#/definitions/FraudDetectionConfig" }, "SpamDetection": { "$ref": "#/definitions/SpamDetectionFileConfig" }, "DlpDetection": { "$ref": "#/definitions/DlpDetectionFileConfig" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementConfig" } }, "additionalProperties": false }, "ContentScanningResult": { "description": "Result of content scanning (downloading and scanning a file from URL)", "type": "object", "properties": { "Enabled": { "description": "Whether content scanning was enabled", "type": "boolean" }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" }, "DownloadedFileFormat": { "description": "Detected file format of downloaded content", "type": "string" }, "NsfwDetection": { "$ref": "#/definitions/NsfwDetectionResult" }, "AiContentDetection": { "$ref": "#/definitions/AiContentDetectionResult" }, "FraudDetection": { "$ref": "#/definitions/FraudDetectionResult" }, "SpamDetection": { "$ref": "#/definitions/SpamDetectionResult" }, "DlpDetection": { "$ref": "#/definitions/DlpDetectionResult" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementResult" } }, "additionalProperties": false }, "DlpDetectionConfig": { "description": "DLP (PII/PHI) detection configuration for text scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable DLP detection", "type": "boolean", "example": true }, "AllowEmailAddresses": { "description": "Allow email addresses", "type": "boolean", "example": false }, "AllowPhoneNumbers": { "description": "Allow phone numbers", "type": "boolean", "example": false }, "AllowStreetAddresses": { "description": "Allow street addresses", "type": "boolean", "example": false }, "AllowPersonNames": { "description": "Allow person names", "type": "boolean", "example": false }, "AllowBirthDates": { "description": "Allow birth dates", "type": "boolean", "example": false }, "AllowPassportNumbers": { "description": "Allow passport numbers", "type": "boolean", "example": false }, "AllowDriversLicenses": { "description": "Allow driver's licenses", "type": "boolean", "example": false }, "AllowSocialSecurityNumbers": { "description": "Allow Social Security numbers", "type": "boolean", "example": false }, "AllowTaxpayerIds": { "description": "Allow taxpayer IDs", "type": "boolean", "example": false }, "AllowCreditCardNumbers": { "description": "Allow credit card numbers", "type": "boolean", "example": false }, "AllowBankAccountNumbers": { "description": "Allow bank account numbers", "type": "boolean", "example": false }, "AllowIbans": { "description": "Allow IBANs", "type": "boolean", "example": false }, "AllowHealthInsuranceNumbers": { "description": "Allow health insurance numbers", "type": "boolean", "example": false }, "AllowBearerTokens": { "description": "Allow bearer tokens", "type": "boolean", "example": false }, "AllowHttpCookies": { "description": "Allow HTTP cookies", "type": "boolean", "example": false }, "AllowPrivateKeys": { "description": "Allow private keys", "type": "boolean", "example": false }, "AllowCredentials": { "description": "Allow credentials", "type": "boolean", "example": false }, "AllowDeepWebUrls": { "description": "Allow deep web URLs", "type": "boolean", "example": false }, "AllowSourceCode": { "description": "Allow source code", "type": "boolean", "example": false }, "AllowIpAddresses": { "description": "Allow IP addresses", "type": "boolean", "example": false }, "AllowMacAddresses": { "description": "Allow MAC addresses", "type": "boolean", "example": false }, "AllowHealthInsuranceMemberIds": { "description": "Allow health insurance member IDs", "type": "boolean", "example": false }, "AllowInjuryDiseaseReferences": { "description": "Allow injury/disease references", "type": "boolean", "example": false }, "AllowTreatmentTypeDescriptions": { "description": "Allow treatment type descriptions", "type": "boolean", "example": false }, "AllowMedicalTreatmentDates": { "description": "Allow medical treatment dates", "type": "boolean", "example": false }, "AllowHealthPlanBeneficiaryNumbers": { "description": "Allow health plan beneficiary numbers", "type": "boolean", "example": false }, "AllowTreatmentPayments": { "description": "Allow treatment payments", "type": "boolean", "example": false }, "AllowVehicleIds": { "description": "Allow vehicle IDs", "type": "boolean", "example": false }, "AllowDeviceIds": { "description": "Allow device IDs", "type": "boolean", "example": false }, "ProvideAnalysisRationale": { "description": "Provide analysis rationale", "type": "boolean", "example": true }, "CustomPolicyID": { "description": "Custom policy ID", "type": "string" } }, "additionalProperties": false }, "DlpDetectionFileConfig": { "description": "DLP detection configuration for file scanning (extends text config with RecognitionMode)", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable DLP detection", "type": "boolean", "example": true }, "AllowEmailAddresses": { "description": "Allow email addresses", "type": "boolean", "example": false }, "AllowPhoneNumbers": { "description": "Allow phone numbers", "type": "boolean", "example": false }, "AllowStreetAddresses": { "description": "Allow street addresses", "type": "boolean", "example": false }, "AllowPersonNames": { "description": "Allow person names", "type": "boolean", "example": false }, "AllowBirthDates": { "description": "Allow birth dates", "type": "boolean", "example": false }, "AllowPassportNumbers": { "description": "Allow passport numbers", "type": "boolean", "example": false }, "AllowDriversLicenses": { "description": "Allow driver's licenses", "type": "boolean", "example": false }, "AllowSocialSecurityNumbers": { "description": "Allow Social Security numbers", "type": "boolean", "example": false }, "AllowTaxpayerIds": { "description": "Allow taxpayer IDs", "type": "boolean", "example": false }, "AllowCreditCardNumbers": { "description": "Allow credit card numbers", "type": "boolean", "example": false }, "AllowBankAccountNumbers": { "description": "Allow bank account numbers", "type": "boolean", "example": false }, "AllowIbans": { "description": "Allow IBANs", "type": "boolean", "example": false }, "AllowHealthInsuranceNumbers": { "description": "Allow health insurance numbers", "type": "boolean", "example": false }, "AllowBearerTokens": { "description": "Allow bearer tokens", "type": "boolean", "example": false }, "AllowHttpCookies": { "description": "Allow HTTP cookies", "type": "boolean", "example": false }, "AllowPrivateKeys": { "description": "Allow private keys", "type": "boolean", "example": false }, "AllowCredentials": { "description": "Allow credentials", "type": "boolean", "example": false }, "AllowDeepWebUrls": { "description": "Allow deep web URLs", "type": "boolean", "example": false }, "AllowSourceCode": { "description": "Allow source code", "type": "boolean", "example": false }, "AllowIpAddresses": { "description": "Allow IP addresses", "type": "boolean", "example": false }, "AllowMacAddresses": { "description": "Allow MAC addresses", "type": "boolean", "example": false }, "AllowHealthInsuranceMemberIds": { "description": "Allow health insurance member IDs", "type": "boolean", "example": false }, "AllowInjuryDiseaseReferences": { "description": "Allow injury/disease references", "type": "boolean", "example": false }, "AllowTreatmentTypeDescriptions": { "description": "Allow treatment type descriptions", "type": "boolean", "example": false }, "AllowMedicalTreatmentDates": { "description": "Allow medical treatment dates", "type": "boolean", "example": false }, "AllowHealthPlanBeneficiaryNumbers": { "description": "Allow health plan beneficiary numbers", "type": "boolean", "example": false }, "AllowTreatmentPayments": { "description": "Allow treatment payments", "type": "boolean", "example": false }, "AllowVehicleIds": { "description": "Allow vehicle IDs", "type": "boolean", "example": false }, "AllowDeviceIds": { "description": "Allow device IDs", "type": "boolean", "example": false }, "ProvideAnalysisRationale": { "description": "Provide analysis rationale", "type": "boolean", "example": true }, "CustomPolicyID": { "description": "Custom policy ID", "type": "string" }, "RecognitionMode": { "description": "Recognition mode: Fast, FastPlus, FastMini", "type": "string", "example": "Fast" } }, "additionalProperties": false }, "DlpDetectionResult": { "description": "DLP (PII/PHI) detection result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no PII/PHI was detected", "type": "boolean" }, "ContainsEmailAddresses": { "description": "Contains email addresses", "type": "boolean" }, "ContainsPhoneNumbers": { "description": "Contains phone numbers", "type": "boolean" }, "ContainsStreetAddresses": { "description": "Contains street addresses", "type": "boolean" }, "ContainsPersonNames": { "description": "Contains person names", "type": "boolean" }, "ContainsBirthDates": { "description": "Contains birth dates", "type": "boolean" }, "ContainsPassportNumbers": { "description": "Contains passport numbers", "type": "boolean" }, "ContainsDriversLicenses": { "description": "Contains driver's licenses", "type": "boolean" }, "ContainsSocialSecurityNumbers": { "description": "Contains Social Security numbers", "type": "boolean" }, "ContainsTaxpayerIds": { "description": "Contains taxpayer IDs", "type": "boolean" }, "ContainsCreditCardNumbers": { "description": "Contains credit card numbers", "type": "boolean" }, "ContainsBankAccountNumbers": { "description": "Contains bank account numbers", "type": "boolean" }, "ContainsIbans": { "description": "Contains IBANs", "type": "boolean" }, "ContainsHealthInsuranceNumbers": { "description": "Contains health insurance numbers", "type": "boolean" }, "ContainsBearerTokens": { "description": "Contains bearer tokens", "type": "boolean" }, "ContainsHttpCookies": { "description": "Contains HTTP cookies", "type": "boolean" }, "ContainsPrivateKeys": { "description": "Contains private keys", "type": "boolean" }, "ContainsCredentials": { "description": "Contains credentials", "type": "boolean" }, "ContainsDeepWebUrls": { "description": "Contains deep web URLs", "type": "boolean" }, "ContainsSourceCode": { "description": "Contains source code", "type": "boolean" }, "ContainsIpAddresses": { "description": "Contains IP addresses", "type": "boolean" }, "ContainsMacAddresses": { "description": "Contains MAC addresses", "type": "boolean" }, "ContainsHealthInsuranceMemberIds": { "description": "Contains health insurance member IDs", "type": "boolean" }, "ContainsInjuryDiseaseReferences": { "description": "Contains injury/disease references", "type": "boolean" }, "ContainsTreatmentTypeDescriptions": { "description": "Contains treatment type descriptions", "type": "boolean" }, "ContainsMedicalTreatmentDates": { "description": "Contains medical treatment dates", "type": "boolean" }, "ContainsHealthPlanBeneficiaryNumbers": { "description": "Contains health plan beneficiary numbers", "type": "boolean" }, "ContainsTreatmentPayments": { "description": "Contains treatment payments", "type": "boolean" }, "ContainsVehicleIds": { "description": "Contains vehicle IDs", "type": "boolean" }, "ContainsDeviceIds": { "description": "Contains device IDs", "type": "boolean" }, "AnalysisRationale": { "description": "Analysis rationale", "type": "string" }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "FileScanResults": { "description": "Individual scan results for a file scan", "type": "object", "properties": { "VirusScan": { "$ref": "#/definitions/VirusScanResult" }, "NsfwDetection": { "$ref": "#/definitions/NsfwDetectionResult" }, "AiContentDetection": { "$ref": "#/definitions/AiContentDetectionResult" }, "FraudDetection": { "$ref": "#/definitions/FraudDetectionResult" }, "PhishingDetection": { "$ref": "#/definitions/PhishingDetectionFileResult" }, "SpamDetection": { "$ref": "#/definitions/SpamDetectionResult" }, "DlpDetection": { "$ref": "#/definitions/DlpDetectionResult" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementResult" } }, "additionalProperties": false }, "FraudDetectionConfig": { "description": "Fraud detection configuration", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable fraud detection", "type": "boolean", "example": true }, "Preprocessing": { "description": "Preprocessing mode: Auto or None", "type": "string", "example": "Auto" }, "ResultCrossCheck": { "description": "Result cross-check mode: None or Advanced", "type": "string", "example": "None" }, "UserEmailAddress": { "description": "User email address for verification context", "type": "string" }, "UserEmailAddressVerified": { "description": "Whether the user email has been verified", "type": "boolean", "example": false }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Fraud Detection Custom Policy created in the Cloudmersive Management Portal, applied by the underlying Fraud Detection API.", "type": "string" } }, "additionalProperties": false }, "FraudDetectionResult": { "description": "Fraud detection result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no fraud was detected", "type": "boolean" }, "FraudRiskLevel": { "format": "double", "description": "Fraud risk level (0.0 to 1.0)", "type": "number" }, "ContainsFinancialLiability": { "description": "Document contains financial liability language", "type": "boolean" }, "ContainsSensitiveInformationCollection": { "description": "Document collects sensitive information", "type": "boolean" }, "ContainsAssetTransfer": { "description": "Document involves asset transfer", "type": "boolean" }, "ContainsPurchaseAgreement": { "description": "Document is a purchase agreement", "type": "boolean" }, "ContainsEmploymentAgreement": { "description": "Document is an employment agreement", "type": "boolean" }, "ContainsExpiredDocument": { "description": "Document is expired", "type": "boolean" }, "ContainsAiGeneratedContent": { "description": "Document contains AI-generated content", "type": "boolean" }, "AnalysisRationale": { "description": "Analysis rationale", "type": "string" }, "DocumentClass": { "description": "Document class/type", "type": "string" }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "MultiThreatCloudStorageResponse": { "description": "Response from a multi-threat cloud-storage scan", "type": "object", "properties": { "Successful": { "description": "True if the operation of retrieving the file from cloud storage and scanning it were successfully completed; false if the file could not be downloaded from cloud storage, or if the file could not be scanned.", "type": "boolean", "example": true }, "CleanResult": { "description": "True if all enabled, non-skipped scans returned clean results (no threats found), false otherwise.", "type": "boolean", "example": true }, "ErrorDetailedDescription": { "description": "Detailed error message if the file could not be downloaded or scanned. Null when Successful is true.", "type": "string" }, "ProviderThrottled": { "description": "True when the cloud storage provider rate-limited (throttled) the download and the operation could not complete. When true, retry the request after ProviderRetryAfterSeconds.", "type": "boolean", "example": false }, "ProviderRetryAfterSeconds": { "format": "int32", "description": "The number of seconds the cloud storage provider asked to wait before retrying, when ProviderThrottled is true. Null when the provider did not supply a wait time.", "type": "integer" }, "FileSize": { "format": "int64", "description": "Size in bytes of the file downloaded from cloud storage.", "type": "integer" }, "ObjectLocation": { "description": "The location of the scanned object within cloud storage (Azure blob path, S3 key name, GCS object name, or SharePoint Online file path / DriveItem ID).", "type": "string", "example": "folder/subfolder/world.pdf" }, "VerifiedFileFormat": { "description": "For file-format-verification-supported file formats, the contents-verified file format of the file. Null indicates the file format is not supported for contents verification. If a virus or malware is found, this field will always be set to null.", "type": "string", "example": ".pdf" }, "ScanResults": { "$ref": "#/definitions/FileScanResults" }, "ContainedDetectionOnlyFindings": { "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.", "type": "boolean" }, "DetectionPending": { "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "ScanCorrelationId": { "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.", "type": "string" }, "Errors": { "description": "Non-fatal conditions encountered during scanning (e.g. scan limits reached). The scan still succeeded; these flag reduced coverage or partial results. Null when none.", "type": "array", "items": { "$ref": "#/definitions/ScanError" } }, "CustomPolicyID": { "description": "Echo of the CustomPolicyID supplied in the request config. Omitted when no custom policy was requested.", "type": "string" }, "CustomPolicyApplied": { "description": "True when the requested custom policy's settings were retrieved and applied; false when a policy was requested but could not be applied (the request-local settings were used instead). Omitted when no custom policy was requested.", "type": "boolean" }, "ProvenanceURL": { "description": "Fully-qualified URL of the scanned object in the source storage system, when available. Omitted when unavailable.", "type": "string", "example": "https://acmestore.blob.core.windows.net/docs/folder/world.pdf" }, "ProvenanceUser": { "description": "User who last modified (or, if unavailable, created or owns) the scanned object, when the source system provides this information. Omitted when unavailable.", "type": "string", "example": "jane.doe@example.com" }, "ProvenanceCreationDate": { "format": "date-time", "description": "Creation date and time (UTC) of the scanned object, when the source system provides this information. Omitted when unavailable.", "type": "string" }, "ProvenanceModifiedDate": { "format": "date-time", "description": "Last-modified date and time (UTC) of the scanned object, when the source system provides this information. Omitted when unavailable.", "type": "string" }, "ProvenanceZoneIdentifier": { "description": "Mark of the Web (Zone.Identifier) information recorded for the source file, when supplied by the caller; may include the URL the file was originally downloaded from. Omitted when unavailable.", "type": "string" }, "ProvenanceTransactionID": { "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "c7a632f4-1c27-4788-9be6-6e58a1cf3a71" }, "ProvenanceClientIP": { "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "203.0.113.42" }, "SanitizedFile": { "format": "byte", "description": "Sanitized (CDR-processed) copy of the scanned object, base64-encoded. Populated only when Content Disarm and Reconstruction is enabled in the scan configuration and ran for this scan; omitted otherwise.", "type": "string" } }, "additionalProperties": false }, "MultiThreatFileResponse": { "description": "Response from a multi-threat file scan", "type": "object", "properties": { "ContainedDetectionOnlyFindings": { "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.", "type": "boolean" }, "DetectionPending": { "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "ScanCorrelationId": { "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.", "type": "string" }, "Successful": { "description": "True if the scan completed successfully", "type": "boolean", "example": true }, "CleanResult": { "description": "True if all enabled scans returned clean results", "type": "boolean", "example": true }, "VerifiedFileFormat": { "description": "Content-verified file format from virus scan", "type": "string", "example": ".pdf" }, "IsArchive": { "description": "True if the scanned file was detected as an archive (e.g. .zip, .rar, .7z, .tar, .gz) and its contents were scanned individually.", "type": "boolean", "example": false }, "ArchiveContents": { "description": "For archives, the per-member scan results. Each member is scanned for all enabled threat types individually; the archive container itself is not sent to any scan API. Null for non-archive files.", "type": "array", "items": { "$ref": "#/definitions/ArchiveEntryScanResult" } }, "ScanResults": { "$ref": "#/definitions/FileScanResults" }, "Errors": { "description": "Non-fatal conditions encountered during scanning (e.g. scan limits reached). The scan still succeeded; these flag reduced coverage or partial results. Null when none.", "type": "array", "items": { "$ref": "#/definitions/ScanError" } }, "CustomPolicyID": { "description": "Echo of the CustomPolicyID supplied in the request config. Omitted when no custom policy was requested.", "type": "string" }, "CustomPolicyApplied": { "description": "True when the requested custom policy's settings were retrieved and applied; false when a policy was requested but could not be applied (the request-local settings were used instead). Omitted when no custom policy was requested.", "type": "boolean" }, "ProvenanceURL": { "description": "Fully-qualified URL or path of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "file://fileserver01/finance/Q3/world.xlsx" }, "ProvenanceUser": { "description": "User who last modified or created the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "jane.doe@example.com" }, "ProvenanceCreationDate": { "format": "date-time", "description": "Creation date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string" }, "ProvenanceModifiedDate": { "format": "date-time", "description": "Last-modified date and time (UTC) of the source file, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string" }, "ProvenanceZoneIdentifier": { "description": "Mark of the Web (Zone.Identifier) information for the source file, echoed from the provenance information supplied in the request config; may include the URL the file was originally downloaded from. Omitted when unavailable.", "type": "string" }, "ProvenanceTransactionID": { "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "c7a632f4-1c27-4788-9be6-6e58a1cf3a71" }, "ProvenanceClientIP": { "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request config. Omitted when unavailable.", "type": "string", "example": "203.0.113.42" }, "SanitizedFile": { "format": "byte", "description": "Sanitized (CDR-processed) copy of the input file, base64-encoded. Present when Content Disarm and Reconstruction is enabled in the scan configuration and produced output for this scan; omitted otherwise (including when the file's format or detected threat is not suitable for sanitization). Note the sanitized copy may be a different file format than the input: HTML inputs are returned as PDF, HEIC as JPG, ODS/ODP as XLSX/PPTX, and some conversions fall back to PDF — detect the actual format from the returned content.", "type": "string" } }, "additionalProperties": false }, "MultiThreatTextRequest": { "description": "Request to scan text for multiple threat types", "type": "object", "properties": { "TextContent": { "description": "The text content to scan", "type": "string", "example": "Check out this amazing offer at http://example.com" }, "VirusScan": { "$ref": "#/definitions/VirusScanConfig" }, "PhishingDetection": { "$ref": "#/definitions/PhishingDetectionTextConfig" }, "SpamDetection": { "$ref": "#/definitions/SpamDetectionConfig" }, "DlpDetection": { "$ref": "#/definitions/DlpDetectionConfig" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementConfig" }, "PromptInjectionDetection": { "$ref": "#/definitions/PromptInjectionDetectionConfig" }, "Provenance": { "$ref": "#/definitions/ProvenanceInfo" }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Multi-Threat Text Scanning Custom Policy created in the Cloudmersive Management Portal under Custom Policies. When set and retrievable, the policy's scan settings REPLACE the detection configurations in this request; the settings in this request are used only if the policy cannot be retrieved. Requires Managed Instance or Private Cloud.", "type": "string" } }, "additionalProperties": false }, "MultiThreatTextResponse": { "description": "Response from a multi-threat text scan", "type": "object", "properties": { "ContainedDetectionOnlyFindings": { "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.", "type": "boolean" }, "DetectionPending": { "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "ScanCorrelationId": { "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.", "type": "string" }, "Successful": { "description": "True if the scan completed successfully", "type": "boolean", "example": true }, "CleanResult": { "description": "True if all enabled scans returned clean results", "type": "boolean", "example": true }, "ScanResults": { "$ref": "#/definitions/TextScanResults" }, "CustomPolicyID": { "description": "Echo of the CustomPolicyID supplied in the request. Omitted when no custom policy was requested.", "type": "string" }, "CustomPolicyApplied": { "description": "True when the requested custom policy's settings were applied to this scan; false when a policy was requested but could not be applied (the scan ran on the request's inline settings). Omitted when no custom policy was requested.", "type": "boolean" }, "ProvenanceURL": { "description": "Fully-qualified URL or path of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "https://acme.sharepoint.com/sites/HR/Shared%20Documents/message.txt" }, "ProvenanceUser": { "description": "User who last modified or created the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "jane.doe@example.com" }, "ProvenanceCreationDate": { "format": "date-time", "description": "Creation date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceModifiedDate": { "format": "date-time", "description": "Last-modified date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceZoneIdentifier": { "description": "Mark of the Web (Zone.Identifier) information for the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceTransactionID": { "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "c7a632f4-1c27-4788-9be6-6e58a1cf3a71" }, "ProvenanceClientIP": { "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "203.0.113.42" } }, "additionalProperties": false }, "MultiThreatUrlRequest": { "description": "Request to scan a URL for multiple threat types", "type": "object", "properties": { "Url": { "description": "The URL to scan (must include http:// or https://)", "type": "string", "example": "https://example.com" }, "UrlSettings": { "$ref": "#/definitions/UrlSettings" }, "VirusScan": { "$ref": "#/definitions/UrlVirusScanConfig" }, "SsrfDetection": { "$ref": "#/definitions/SsrfDetectionConfig" }, "PhishingDetection": { "$ref": "#/definitions/UrlPhishingDetectionConfig" }, "PromptInjectionDetection": { "$ref": "#/definitions/PromptInjectionDetectionConfig" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementConfig" }, "ContentScanning": { "$ref": "#/definitions/ContentScanningConfig" }, "Provenance": { "$ref": "#/definitions/ProvenanceInfo" }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Multi-Threat URL Scanning Custom Policy created in the Cloudmersive Management Portal under Custom Policies. When set and retrievable, the policy's scan settings REPLACE the detection configurations in this request; the settings in this request are used only if the policy cannot be retrieved. Requires Managed Instance or Private Cloud.", "type": "string" } }, "additionalProperties": false }, "MultiThreatUrlResponse": { "description": "Response from a multi-threat URL scan", "type": "object", "properties": { "ContainedDetectionOnlyFindings": { "description": "True when at least one category running in Detection mode reported a finding that did NOT affect CleanResult. Omitted when no such finding occurred.", "type": "boolean" }, "DetectionPending": { "description": "True when one or more categories are running asynchronously (OutcomeAction \"Detection\"); their findings are not in this response and will appear in the scan outcome telemetry, correlated by ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "ScanCorrelationId": { "description": "Server-generated ID correlating this response with the delayed scan outcome telemetry event, which is emitted when the background detection completes and carries its findings. Present only when DetectionPending is true.", "type": "string" }, "Successful": { "description": "True if the scan completed successfully", "type": "boolean", "example": true }, "CleanResult": { "description": "True if all enabled scans returned clean results", "type": "boolean", "example": true }, "ScanResults": { "$ref": "#/definitions/UrlScanResults" }, "CustomPolicyID": { "description": "Echo of the CustomPolicyID supplied in the request. Omitted when no custom policy was requested.", "type": "string" }, "CustomPolicyApplied": { "description": "True when the requested custom policy's settings were applied to this scan; false when a policy was requested but could not be applied (the scan ran on the request's inline settings). Omitted when no custom policy was requested.", "type": "boolean" }, "ProvenanceURL": { "description": "Fully-qualified URL or path of the source of the scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceUser": { "description": "User associated with the source of the scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "jane.doe@example.com" }, "ProvenanceCreationDate": { "format": "date-time", "description": "Creation date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceModifiedDate": { "format": "date-time", "description": "Last-modified date and time (UTC) of the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceZoneIdentifier": { "description": "Mark of the Web (Zone.Identifier) information for the source content, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string" }, "ProvenanceTransactionID": { "description": "Caller-assigned transaction identifier for the scan, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "c7a632f4-1c27-4788-9be6-6e58a1cf3a71" }, "ProvenanceClientIP": { "description": "IP address of the client that originated the source content or scan request, echoed from the provenance information supplied in the request. Omitted when unavailable.", "type": "string", "example": "203.0.113.42" } }, "additionalProperties": false }, "NsfwDetectionConfig": { "description": "NSFW detection configuration", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable NSFW detection", "type": "boolean", "example": true }, "Mode": { "description": "Classification mode: \"Basic\" (default) returns an overall NSFW risk score; \"Advanced\" additionally classifies the image into content categories (nudity, violence, self-harm, hate, illegal activity, medical imagery, profanity) with per-category allow settings.", "type": "string", "example": "Basic" }, "MinimumScore": { "format": "double", "description": "Optional minimum NSFW score (0.0-1.0). When set, an image whose NSFW score is at or above this threshold fails the scan, in both modes. When not set: Basic mode applies a default threshold of 0.8; Advanced mode does not evaluate the score (the category allow settings decide the result).", "type": "number", "example": 0.8 }, "AllowNudity": { "description": "Advanced mode only. When true, images classified as containing nudity do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowGraphicViolence": { "description": "Advanced mode only. When true, images classified as containing graphic violence do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowNonGraphicViolence": { "description": "Advanced mode only. When true, images classified as containing non-graphic violence do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowSelfHarm": { "description": "Advanced mode only. When true, images classified as containing self-harm content do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowHate": { "description": "Advanced mode only. When true, images classified as containing hate content or symbols do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowPotentialIllegalActivity": { "description": "Advanced mode only. When true, images classified as depicting potentially illegal activity do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowMedicalImagery": { "description": "Advanced mode only. When true, images classified as medical imagery do not fail the scan. Default false.", "type": "boolean", "example": false }, "AllowProfanity": { "description": "Advanced mode only. When true, images classified as containing profanity do not fail the scan. Default false.", "type": "boolean", "example": false } }, "additionalProperties": false }, "NsfwDetectionResult": { "description": "NSFW detection result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no NSFW content was found", "type": "boolean" }, "Mode": { "description": "Classification mode that ran: \"Basic\" or \"Advanced\". Omitted when the scan did not run.", "type": "string", "example": "Basic" }, "ContainsNudity": { "description": "Image contains nudity. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsGraphicViolence": { "description": "Image contains graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsNonGraphicViolence": { "description": "Image contains non-graphic violence. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsSelfHarm": { "description": "Image contains self-harm content. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsHate": { "description": "Image contains hate content. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsPotentialIllegalActivity": { "description": "Image contains potential illegal activity. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsMedicalImagery": { "description": "Image contains medical imagery. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "ContainsProfanity": { "description": "Image contains profanity. Populated in Advanced mode; omitted in Basic mode (not evaluated).", "type": "boolean" }, "Score": { "format": "double", "description": "NSFW score (0.0 to 1.0)", "type": "number" }, "ClassificationOutcome": { "description": "Classification outcome", "type": "string" }, "Skipped": { "description": "Scan was skipped (unsupported format)", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "PhishingDetectionFileResult": { "description": "Phishing detection result for file scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no phishing was detected", "type": "boolean" }, "ContainsPhishing": { "description": "File contains phishing", "type": "boolean" }, "UnsafeUrls": { "description": "List of unsafe URLs found in the file. Populated by the Basic pipeline (Basic mode, the Advanced-mode local pre-check, or the QR-code supplement); null when none were flagged.", "type": "array", "items": { "$ref": "#/definitions/UnsafeUrlInfo" } }, "ContainsPhishingQrCode": { "description": "QR-code phishing verdict. True: a URL decoded from an embedded QR code was classified as phishing. False: QR scanning ran and found no phishing QR codes. Null: QR scanning did not run (ScanQrCodes disabled, unsupported file format, or the QR stage was skipped).", "type": "boolean", "example": false }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "PhishingDetectionTextConfig": { "description": "Phishing detection configuration for text scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable phishing detection", "type": "boolean", "example": true }, "Mode": { "description": "Detection pipeline: \"Basic\" (local URL-reputation analysis, default) or \"Advanced\" (remote AI phishing analysis).", "type": "string", "example": "Basic" }, "TextType": { "description": "Type of text: TextMessage, UserMessage, SalesLead, EmailMessage, SupportCase, AppMessage, Other. Applies to Advanced mode only.", "type": "string", "example": "EmailMessage" }, "Model": { "description": "Model to use: Normal or Advanced", "type": "string", "example": "Advanced" }, "AllowUnsolicitedSales": { "description": "Allow unsolicited sales content", "type": "boolean", "example": true }, "AllowPromotionalContent": { "description": "Allow promotional content", "type": "boolean", "example": true }, "AllowWebUrls": { "description": "Allow web URLs in content", "type": "boolean", "example": true }, "AllowPhoneNumbers": { "description": "Allow phone numbers in content", "type": "boolean", "example": true }, "AllowEmailAddresses": { "description": "Allow email addresses in content", "type": "boolean", "example": true }, "ProvideUrlAnalysis": { "description": "Provide URL analysis details", "type": "boolean", "example": true }, "CustomPolicyID": { "description": "Custom policy ID for managed instances", "type": "string" }, "ProvideAnalysisRationale": { "description": "Provide analysis rationale in response", "type": "boolean", "example": true }, "FromName": { "description": "Name of the sender", "type": "string" }, "ToName": { "description": "Name of the recipient", "type": "string" }, "FromPhoneNumber": { "description": "Phone number of the sender", "type": "string" }, "ToPhoneNumber": { "description": "Phone number of the recipient", "type": "string" }, "FromEmailAddress": { "description": "Email address of the sender", "type": "string" }, "ToEmailAddress": { "description": "Email address of the recipient", "type": "string" } }, "additionalProperties": false }, "PhishingDetectionTextResult": { "description": "Phishing detection result for text scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no phishing was detected", "type": "boolean" }, "ContainsPhishing": { "description": "Text contains phishing", "type": "boolean" }, "ContainsUnsolicitedSales": { "description": "Text contains unsolicited sales", "type": "boolean" }, "ContainsPromotionalContent": { "description": "Text contains promotional content", "type": "boolean" }, "ContainsWebUrls": { "description": "Text contains web URLs", "type": "boolean" }, "ContainsPhoneNumbers": { "description": "Text contains phone numbers", "type": "boolean" }, "ContainsEmailAddresses": { "description": "Text contains email addresses", "type": "boolean" }, "ConfidenceLevel": { "format": "double", "description": "Confidence level (0.0 to 1.0)", "type": "number" }, "AnalysisRationale": { "description": "Analysis rationale", "type": "string" }, "UnsafeUrls": { "description": "List of unsafe URLs found", "type": "array", "items": { "$ref": "#/definitions/UnsafeUrlInfo" } } }, "additionalProperties": false }, "PhishingDetectionUrlResult": { "description": "Phishing detection result for URL scanning", "type": "object", "properties": { "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no phishing was detected", "type": "boolean" }, "PhishingRiskLevel": { "format": "double", "description": "Phishing risk level (0.0 to 1.0)", "type": "number" }, "IsSsrfThreat": { "description": "URL is a server-side request forgery threat", "type": "boolean" }, "ContainsPhishing": { "description": "URL contains phishing", "type": "boolean" }, "ContainsUnsolicitedSales": { "description": "URL contains unsolicited sales", "type": "boolean" }, "ContainsPromotionalContent": { "description": "URL contains promotional content", "type": "boolean" }, "ContainsPhishingAttempt": { "description": "URL contains phishing attempt", "type": "boolean" }, "AnalysisRationale": { "description": "Analysis rationale", "type": "string" }, "ThreatTypes": { "description": "Threat classifications for this URL. Possible values: Phishing, Malware, UnwantedSoftware, Unsafe, SSRF, Phishing Test URL. Populated by the Basic pipeline (Basic mode, or the Advanced-mode local pre-check); null when the verdict came from the remote Advanced analysis.", "type": "array", "items": { "type": "string" } } }, "additionalProperties": false }, "PolicyEnforcementConfig": { "description": "Policy enforcement configuration with custom rules", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable policy enforcement", "type": "boolean", "example": false }, "Rules": { "description": "List of policy rules to enforce", "type": "array", "items": { "$ref": "#/definitions/PolicyRule" } }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Custom Policy created in the Cloudmersive Management Portal whose ALLOW and BLOCK rules are enforced as content rules. Used only when Rules is not supplied; when both are present, Rules takes precedence. Requires Managed Instance or Private Cloud.", "type": "string" } }, "additionalProperties": false }, "PolicyEnforcementResult": { "description": "Policy enforcement result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no policy violations were found", "type": "boolean" }, "RiskScore": { "format": "double", "description": "Overall risk score (0.0 to 1.0)", "type": "number" }, "RuleViolations": { "description": "List of rule violations found", "type": "array", "items": { "$ref": "#/definitions/PolicyRuleViolation" } }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "PolicyRule": { "description": "A single policy rule", "type": "object", "properties": { "RuleId": { "description": "Unique rule identifier", "type": "string", "example": "RULE-001" }, "RuleType": { "description": "Rule type: ALLOW or DENY", "type": "string", "example": "DENY" }, "RuleDescription": { "description": "Natural language description of the policy rule", "type": "string", "example": "Documents must not contain financial advice" } }, "additionalProperties": false }, "PolicyRuleViolation": { "description": "A single policy rule violation", "type": "object", "properties": { "RuleId": { "description": "ID of the violated rule", "type": "string" }, "RuleViolationRiskScore": { "format": "double", "description": "Risk score for this violation (0.0 to 1.0)", "type": "number" }, "RuleViolationRationale": { "description": "Rationale for the violation", "type": "string" } }, "additionalProperties": false }, "PromptInjectionDetectionConfig": { "description": "Prompt injection detection configuration for a URL scan (Spec/UrlPromptInjectionDetection.md).\r\nDisabled by default.", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable prompt injection detection. Default false.", "type": "boolean", "example": false }, "MinimumRiskLevel": { "description": "Optional additional strictness: \"Medium\" or \"High\". When set, content whose RiskLevel is at or above this level is flagged IN ADDITION to the detection service's own verdict (this setting can only add flags, never remove them). Unset uses the detection service's verdict exactly.", "type": "string", "example": "High" } }, "additionalProperties": false }, "PromptInjectionDetectionResult": { "description": "Prompt injection detection result. For URL scans the service downloads the URL, extracts\r\nreadable text (HTML via HtmlAgilityPack, otherwise sniffed plain text; binary content is\r\nskipped) and scans it; for text scans the submitted text is scanned directly. Both run\r\nthrough the Prompt Injection child API.", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no prompt injection was detected", "type": "boolean" }, "ContainedPromptInjection": { "description": "The extracted content contained a prompt injection attack (inverse of CleanResult)", "type": "boolean" }, "RiskLevel": { "description": "Risk level of the scanned text: Low, Medium, High, or Critical.", "type": "string" }, "RiskScore": { "format": "double", "description": "Classifier confidence that the text contains a prompt injection, 0.0 (safe) to 1.0 (injection).", "type": "number" }, "Skipped": { "description": "Scan was skipped (e.g. SSRF threat detected, binary content, or no readable text).", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped.", "type": "string" } }, "additionalProperties": false }, "ProvenanceInfo": { "description": "Caller-supplied provenance describing where the input file came from\r\n(Spec/ProvenanceFields.md §3.7). Values are opaque caller data: echoed back in the\r\nscan result, never validated against the source system, and never used in scan logic.\r\nOn the cloud-storage endpoints, source-derived provenance takes precedence\r\nfield-by-field; these values fill only the fields the source could not provide.", "type": "object", "properties": { "ProvenanceURL": { "description": "Fully-qualified URL or path of the source object, such as an https:// cloud storage URL or a file:// path for a network share file.", "type": "string", "example": "file://fileserver01/finance/Q3/world.xlsx" }, "ProvenanceUser": { "description": "User who last modified or created the source object.", "type": "string", "example": "jane.doe@example.com" }, "ProvenanceCreationDate": { "format": "date-time", "description": "Creation date and time (UTC) of the source object.", "type": "string" }, "ProvenanceModifiedDate": { "format": "date-time", "description": "Last-modified date and time (UTC) of the source object.", "type": "string" }, "ProvenanceZoneIdentifier": { "description": "Mark of the Web (Zone.Identifier) information for the source file, when available; may include the URL the file was originally downloaded from.", "type": "string" }, "ProvenanceTransactionID": { "description": "Caller-assigned transaction identifier for the scan, useful for correlating the scan result with the caller's own systems.", "type": "string", "example": "c7a632f4-1c27-4788-9be6-6e58a1cf3a71" }, "ProvenanceClientIP": { "description": "IP address of the client that originated the source content or scan request.", "type": "string", "example": "203.0.113.42" } }, "additionalProperties": false }, "RecursiveLinkScanResult": { "description": "Recursive link scan result (Spec/UrlRecursiveLinkScan.md): the outcome of parsing the\r\nlanding page's HTML, extracting its links, and scanning each one at depth 1.", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether recursive link scanning was enabled for this request.", "type": "boolean" }, "Successful": { "description": "Whether the recursion machinery ran (landing page fetched and parsed). An individual link's scan failure does not clear this flag.", "type": "boolean" }, "CleanResult": { "description": "True if every scanned link was clean (true when zero links were scanned).", "type": "boolean" }, "LinksFound": { "format": "int32", "description": "Distinct in-scope links extracted from the landing page.", "type": "integer" }, "LinksScanned": { "format": "int32", "description": "Links actually scanned (found minus those already seen / over the cap).", "type": "integer" }, "Skipped": { "description": "Recursion was suppressed (e.g. SSRF-blocked landing page, non-HTML content, kill switch off).", "type": "boolean" }, "SkipReason": { "description": "Reason recursion was skipped, when Skipped is true.", "type": "string" }, "ScannedLinks": { "description": "Per-link scan summaries.", "type": "array", "items": { "$ref": "#/definitions/ScannedLinkResult" } } }, "additionalProperties": false }, "ScanError": { "description": "A non-fatal condition encountered during scanning that reduced coverage or\r\nproduced a partial result (the scan itself still succeeded).", "type": "object", "properties": { "Code": { "description": "Stable machine-readable code, e.g. \"ScanLimitReached\".", "type": "string", "example": "ScanLimitReached" }, "Detail": { "description": "Human-readable detail.", "type": "string" } }, "additionalProperties": false }, "ScannedLinkResult": { "description": "Compact per-link summary for a recursively scanned link.", "type": "object", "properties": { "Url": { "description": "The scanned link URL.", "type": "string" }, "Successful": { "description": "Whether that link's scan completed successfully.", "type": "boolean" }, "CleanResult": { "description": "Whether that link scanned clean.", "type": "boolean" } }, "additionalProperties": false }, "SpamDetectionConfig": { "description": "Spam detection configuration", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable spam detection", "type": "boolean", "example": true }, "Model": { "description": "Model to use: Normal or Advanced", "type": "string", "example": "Advanced" }, "AllowUnsolicitedSales": { "description": "Allow unsolicited sales content", "type": "boolean", "example": false }, "AllowPromotionalContent": { "description": "Allow promotional content", "type": "boolean", "example": true }, "AllowPhishing": { "description": "Allow phishing content", "type": "boolean", "example": false }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Spam Detection Custom Policy created in the Cloudmersive Management Portal, applied by the underlying Spam Detection API.", "type": "string" } }, "additionalProperties": false }, "SpamDetectionFileConfig": { "description": "Spam detection configuration for file scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable spam detection", "type": "boolean", "example": true }, "Model": { "description": "Model to use: Normal or Advanced", "type": "string", "example": "Advanced" }, "Preprocessing": { "description": "Preprocessing mode: None, Compatability, Auto", "type": "string", "example": "Auto" }, "AllowPhishing": { "description": "Allow phishing content", "type": "boolean", "example": false }, "AllowUnsolicitedSales": { "description": "Allow unsolicited sales", "type": "boolean", "example": false }, "AllowPromotionalContent": { "description": "Allow promotional content", "type": "boolean", "example": true }, "CustomPolicyID": { "description": "Optional ID (GUID) of a Spam Detection Custom Policy created in the Cloudmersive Management Portal, applied by the underlying Spam Detection API.", "type": "string" } }, "additionalProperties": false }, "SpamDetectionResult": { "description": "Spam detection result", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no spam was detected", "type": "boolean" }, "SpamRiskLevel": { "format": "double", "description": "Spam risk level (0.0 to 1.0)", "type": "number" }, "ContainsSpam": { "description": "Content contains spam", "type": "boolean" }, "ContainsUnsolicitedSales": { "description": "Content contains unsolicited sales", "type": "boolean" }, "ContainsPromotionalContent": { "description": "Content contains promotional material", "type": "boolean" }, "ContainsPhishingAttempt": { "description": "Content contains phishing attempt", "type": "boolean" }, "AnalysisRationale": { "description": "Analysis rationale", "type": "string" }, "Skipped": { "description": "Scan was skipped", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" } }, "additionalProperties": false }, "SsrfDetectionConfig": { "description": "SSRF (server-side request forgery) detection configuration for URL scanning.\r\nEach setting can be forced server-side via a MultiScan_Ssrf_Force_* cloud\r\nconfiguration key, in which case the client-supplied value is ignored.\r\nSee Spec/UrlScanSsrfDetectionAndAdvancedVirusScan.md.", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action for this category: \"Block\" (default) sets the overall CleanResult to false when this category is not clean; \"Detection\" runs the category asynchronously after the response returns (findings appear in scan telemetry only, subject to Limits.DetectionSamplingRate); \"DetectionSync\" runs it inline and reports its result in the response without affecting the overall CleanResult.", "type": "string", "example": "Block" }, "Enabled": { "description": "Enable SSRF detection. Default true. When enabled, an SSRF-flagged URL fails closed and the fetch-based scans are skipped.", "type": "boolean", "example": true }, "AllowUnencrypted": { "description": "Allow unencrypted http:// URLs. Default true.", "type": "boolean", "example": true }, "AllowSpecializedSchemes": { "description": "Allow schemes other than http/https (ftp:, file:, custom schemes, ...). Default false.", "type": "boolean", "example": false }, "AllowIpLiteralHosts": { "description": "Allow IPv4/IPv6 literal hosts. Default false.", "type": "boolean", "example": false }, "AllowInternalHosts": { "description": "Allow internal-style hostnames (localhost, metadata.google.internal, *.local, single-label hosts). Default false.", "type": "boolean", "example": false }, "AllowCredentialsInUrl": { "description": "Allow credentials (user:pass@) in the URL. Default false.", "type": "boolean", "example": false }, "AllowPrivateNetworkTargets": { "description": "Allow hosts whose DNS resolution includes private/reserved network addresses. Default false.", "type": "boolean", "example": false } }, "additionalProperties": false }, "SsrfDetectionResult": { "description": "SSRF (server-side request forgery) detection result for URL scanning", "type": "object", "properties": { "OutcomeAction": { "description": "Outcome action applied to this category. Present only for the detection modes: \"Detection\" (ran asynchronously — see Pending) or \"DetectionSync\" (ran inline, reported below, did not affect the overall CleanResult).", "type": "string" }, "Pending": { "description": "True when this category is running asynchronously (OutcomeAction \"Detection\"): its findings are not in this response and will be emitted in the scan outcome telemetry, correlated by the response ScanCorrelationId. Omitted otherwise.", "type": "boolean" }, "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no SSRF threat was found", "type": "boolean" }, "IsSsrfThreat": { "description": "URL is a server-side request forgery threat", "type": "boolean" }, "ThreatTypes": { "description": "SSRF threat classifications found. Possible values: UnparseableUrl, SpecializedScheme, Unencrypted, CredentialsInUrl, IpLiteralHost, InternalHost, PrivateNetworkTarget, and RedirectTarget: for threats found on a download redirect hop.", "type": "array", "items": { "type": "string" } }, "DnsResolved": { "description": "Whether the host's DNS name resolved during the private-network check. Null when the DNS step did not run (IP-literal host, check disabled, or an earlier lexical threat).", "type": "boolean" } }, "additionalProperties": false }, "TextScanResults": { "description": "Individual scan results for a text scan", "type": "object", "properties": { "VirusScan": { "$ref": "#/definitions/VirusScanResult" }, "PhishingDetection": { "$ref": "#/definitions/PhishingDetectionTextResult" }, "SpamDetection": { "$ref": "#/definitions/SpamDetectionResult" }, "DlpDetection": { "$ref": "#/definitions/DlpDetectionResult" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementResult" }, "PromptInjectionDetection": { "$ref": "#/definitions/PromptInjectionDetectionResult" } }, "additionalProperties": false }, "UnsafeUrlInfo": { "description": "Information about an unsafe URL", "type": "object", "properties": { "Url": { "description": "The URL", "type": "string" }, "CleanResult": { "description": "True if URL is clean", "type": "boolean" }, "IsSsrfThreat": { "description": "URL is an SSRF threat", "type": "boolean" }, "ContainsPhishing": { "description": "URL contains phishing", "type": "boolean" }, "ThreatTypes": { "description": "Threat classifications for this URL. Possible values: Phishing, Malware, UnwantedSoftware, Unsafe, SSRF, Phishing Test URL. Populated by the Basic pipeline (Basic mode, or the Advanced-mode local pre-check); null when the verdict came from the remote Advanced analysis.", "type": "array", "items": { "type": "string" } } }, "additionalProperties": false }, "UrlPhishingDetectionConfig": { "description": "URL-specific phishing detection configuration", "type": "object", "properties": { "Enabled": { "description": "Enable phishing detection", "type": "boolean", "example": true }, "Mode": { "description": "Detection pipeline: \"Basic\" (local URL-reputation analysis, default) or \"Advanced\" (remote AI phishing analysis).", "type": "string", "example": "Basic" }, "CustomPolicyID": { "description": "Custom policy ID. Applies to Advanced mode only.", "type": "string" } }, "additionalProperties": false }, "UrlScanResults": { "description": "Individual scan results for a URL scan", "type": "object", "properties": { "VirusScan": { "$ref": "#/definitions/VirusScanUrlResult" }, "SsrfDetection": { "$ref": "#/definitions/SsrfDetectionResult" }, "PhishingDetection": { "$ref": "#/definitions/PhishingDetectionUrlResult" }, "PromptInjectionDetection": { "$ref": "#/definitions/PromptInjectionDetectionResult" }, "PolicyEnforcement": { "$ref": "#/definitions/PolicyEnforcementResult" }, "ContentScanning": { "$ref": "#/definitions/ContentScanningResult" }, "RecursiveLinkScan": { "$ref": "#/definitions/RecursiveLinkScanResult" } }, "additionalProperties": false }, "UrlSettings": { "description": "Optional top-level settings for a URL scan that apply to the request as a whole\r\n(as opposed to a single sub-scan). Additive; defaults preserve current behavior.\r\nSee Spec/UrlRecursiveLinkScan.md.", "type": "object", "properties": { "RecursiveLinkScanOutcomeAction": { "description": "Outcome action for recursive link scanning: \"Block\" (default) fails the scan when a scanned link is not clean; \"Detection\" reports it but does not affect the overall CleanResult.", "type": "string" }, "RecursivelyScanLinks": { "description": "When true, after the submitted URL is scanned its landing page is parsed as HTML,\r\nthe links it contains are extracted, and each link is recursively scanned with the\r\nsame scan configuration (max link depth 1; each URL scanned at most once). If any\r\nscanned link is not clean, the overall result is not clean. Default false.", "type": "boolean", "example": false } }, "additionalProperties": false }, "UrlVirusScanConfig": { "description": "URL-specific virus scan configuration", "type": "object", "properties": { "Enabled": { "description": "Enable virus scanning", "type": "boolean", "example": true }, "Mode": { "description": "Scan pipeline: \"Basic\" (the remote website reputation scan) or \"Advanced\" (default — after SSRF detection passes, download the URL's binary content and run the Advanced Virus Scan on the bytes). See Spec/UrlScanSsrfDetectionAndAdvancedVirusScan.md.", "type": "string", "example": "Advanced" }, "AdvancedVirusScanSettings": { "$ref": "#/definitions/AdvancedVirusScanSettings" } }, "additionalProperties": false }, "VirusFound": { "description": "Virus found detail", "type": "object", "properties": { "FileName": { "description": "Name of the file containing the virus", "type": "string" }, "VirusName": { "description": "Name of the virus", "type": "string" } }, "additionalProperties": false }, "VirusScanConfig": { "description": "Virus scan configuration", "type": "object", "properties": { "Enabled": { "description": "Enable virus scanning", "type": "boolean", "example": true }, "AllowExecutables": { "description": "Allow executable files", "type": "boolean", "example": false }, "AllowInvalidFiles": { "description": "Allow invalid files", "type": "boolean", "example": false }, "AllowScripts": { "description": "Allow script files", "type": "boolean", "example": false }, "AllowPasswordProtectedFiles": { "description": "Allow password-protected files", "type": "boolean", "example": false }, "AllowMacros": { "description": "Allow files containing macros", "type": "boolean", "example": false }, "AllowXmlExternalEntities": { "description": "Allow XML external entities", "type": "boolean", "example": false }, "AllowInsecureDeserialization": { "description": "Allow insecure deserialization", "type": "boolean", "example": false }, "AllowHtml": { "description": "Allow HTML content", "type": "boolean", "example": false }, "AllowUnsafeArchives": { "description": "Allow unsafe archives", "type": "boolean", "example": false }, "AllowOleEmbeddedObject": { "description": "Allow OLE embedded objects", "type": "boolean", "example": false }, "AllowUnwantedAction": { "description": "Allow unwanted actions", "type": "boolean", "example": false }, "AllowAuthenticodeSignedExecutables": { "description": "Allow an executable that carries an Authenticode signature meeting MinimumAuthenticodeSigningLevel, even when AllowExecutables is false. Default false, in which case scanning behaves exactly as it does without this setting. PE files (.exe/.dll/.sys) only — a signed .msi is still blocked.", "type": "boolean", "example": false }, "MinimumAuthenticodeSigningLevel": { "description": "Minimum Authenticode signing level an executable must meet to be allowed by AllowAuthenticodeSignedExecutables. Currently only \"Signed\" is supported, which asserts a well-formed signature is present — NOT that the signer is trusted; a self-signed executable qualifies.", "type": "string", "example": "Signed" }, "RestrictFileTypes": { "description": "Restrict to specific file types (comma-separated extensions)", "type": "string", "example": ".pdf,.docx,.png" }, "Options": { "description": "Comma-separated scan options", "type": "string" } }, "additionalProperties": false }, "VirusScanContentInfo": { "description": "Additional content information from virus scan", "type": "object", "properties": { "ContainsJSON": { "description": "File contains JSON content", "type": "boolean" }, "ContainsXML": { "description": "File contains XML content", "type": "boolean" }, "ContainsImage": { "description": "File contains image content", "type": "boolean" }, "Hash_SHA1": { "description": "SHA-1 hash of the file", "type": "string" }, "RelevantSubfileName": { "description": "Name of relevant subfile", "type": "string" }, "RelevantSubfileHash_SHA1": { "description": "SHA-1 hash of relevant subfile", "type": "string" }, "IsAuthenticodeSigned": { "description": "File has Authenticode signature", "type": "boolean" } }, "additionalProperties": false }, "VirusScanResult": { "description": "Virus scan result", "type": "object", "properties": { "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no threats were found", "type": "boolean" }, "ContainsExecutable": { "description": "Contains executable content", "type": "boolean" }, "ContainsInvalidFile": { "description": "Contains invalid file structure", "type": "boolean" }, "ContainsScript": { "description": "Contains script content", "type": "boolean" }, "ContainsPasswordProtectedFile": { "description": "File is password-protected", "type": "boolean" }, "ContainsRestrictedFileFormat": { "description": "File format is restricted", "type": "boolean" }, "ContainsMacros": { "description": "Contains macro code", "type": "boolean" }, "ContainsXmlExternalEntities": { "description": "Contains XML external entities", "type": "boolean" }, "ContainsInsecureDeserialization": { "description": "Contains insecure deserialization", "type": "boolean" }, "ContainsHtml": { "description": "Contains HTML content", "type": "boolean" }, "ContainsUnsafeArchive": { "description": "Contains unsafe archive structure", "type": "boolean" }, "ContainsOleEmbeddedObject": { "description": "Contains OLE embedded objects", "type": "boolean" }, "ContainsUnwantedAction": { "description": "Contains unwanted actions", "type": "boolean" }, "VerifiedFileFormat": { "description": "Content-verified file format", "type": "string" }, "FoundViruses": { "description": "List of viruses found", "type": "array", "items": { "$ref": "#/definitions/VirusFound" } }, "ContentInformation": { "$ref": "#/definitions/VirusScanContentInfo" }, "AuthenticodeSigningLevel": { "description": "The Authenticode signing level this API computed for the file: \"None\" or \"Signed\". Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content. Null otherwise.", "type": "string", "example": "Signed" }, "AllowedByAuthenticode": { "description": "True only when the Authenticode override admitted an executable that would otherwise have been blocked. False when the file was allowed because AllowExecutables was already true — the two cases are otherwise indistinguishable to a caller who cannot see the effective policy. Populated only when VirusScan.AllowAuthenticodeSignedExecutables is on and the file contains executable content; omitted otherwise, so an off toggle leaves the response unchanged.", "type": "boolean", "example": false }, "ErrorMessage": { "description": "Error message if the scan failed", "type": "string" } }, "additionalProperties": false }, "VirusScanUrlResult": { "description": "Virus scan result for URL scanning", "type": "object", "properties": { "Enabled": { "description": "Whether this scan was enabled", "type": "boolean" }, "Successful": { "description": "Whether this scan completed successfully", "type": "boolean" }, "CleanResult": { "description": "True if no threats were found", "type": "boolean" }, "WebsiteThreatType": { "description": "Website threat type: None, Malware, Phishing, ForcedDownload, UnableToConnect", "type": "string" }, "FoundViruses": { "description": "List of viruses found", "type": "array", "items": { "$ref": "#/definitions/VirusFound" } }, "WebsiteHttpResponseCode": { "format": "int32", "description": "HTTP response code from the website", "type": "integer" }, "AdvancedScanResult": { "$ref": "#/definitions/VirusScanResult" }, "Skipped": { "description": "Scan was skipped (e.g. SSRF threat detected)", "type": "boolean" }, "SkipReason": { "description": "Reason the scan was skipped", "type": "string" }, "ErrorMessage": { "description": "Error message when the scan did not complete (e.g. the download exceeded the maximum size)", "type": "string" } }, "additionalProperties": false } }, "securityDefinitions": { "Apikey": { "type": "apiKey", "name": "Apikey", "in": "header", "description": "Apikey" } }, "security": [ { "Apikey": [] } ], "host": "testapi.cloudmersive.com" }