Upload API Scan Status Contract

Purpose

Define the Upload API response contract for file uploads that include malware scan results produced by Microsoft Defender for Storage

This document defines:

• Upload response fields
• Malware scan result behavior
• Timing behavior for scan availability
• Post-upload scan result retrieval

---

Data Model Alignment

The Upload API is backed by the [fileIntake].[File] table

Relevant fields:

• FileID
• InternalUrl
• HashValue
• MalwareScanResult

InternalUrl is used as the correlation ID between File Intake and Defender for Storage

MalwareScanResult stores the scan result reported by Defender

---

Upload Request Behavior

• The uploaded file is written to Blob Storage
• A row is created in [fileIntake].[File] with:
  • FileID
  • InternalUrl
  • HashValue
  • MalwareScanResult set to null
• Malware scanning begins asynchronously after the blob is created

---

Scan Result Availability

• Malware scanning is asynchronous
• File Intake may wait up to five seconds after upload completion to check for a scan result.
• If no scan result has been recorded, the file is considered pending

Pending is determined by MalwareScanResult being null

---

Upload Response Fields

The Upload API response includes:

• fileId
• message
• filePath
• filename
• hashValue
• malwareScanResult

---

Upload Response Behavior

• If MalwareScanResult is null:
  • malwareScanResult is returned as Pending
• If MalwareScanResult has a value:
  • malwareScanResult is returned as the value stored in the database

---

Malware Scan Result Values

MalwareScanResult may contain the following values returned by Defender:

• No Threat Found
• Malicious
• Error
• Not Scanned

If MalwareScanResult is null, the scan result is pending

---

Batch Upload Behavior

• Each uploaded file is processed independently
• Each file has its own FileID, InternalUrl, and MalwareScanResult
• Scan results may complete at different times within a batch