> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://cla-demo.postmansolutions.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://cla-demo.postmansolutions.com/_mcp/server.

# Upload API Scan Status Contract

## Purpose

Define the Upload API response contract for file uploads that include malware scan results produced by Microsoft Defender for Storage

This document defines:

* Upload response fields
* Malware scan result behavior
* Timing behavior for scan availability
* Post-upload scan result retrieval

---

## Data Model Alignment

The Upload API is backed by the \[fileIntake].\[File] table

Relevant fields:

* FileID
* InternalUrl
* HashValue
* MalwareScanResult

> InternalUrl is used as the correlation ID between File Intake and Defender for Storage

> MalwareScanResult stores the scan result reported by Defender

---

## Upload Request Behavior

* The uploaded file is written to Blob Storage
* A row is created in \[fileIntake].\[File] with:
  * FileID
  * InternalUrl
  * HashValue
  * MalwareScanResult set to null
* Malware scanning begins asynchronously after the blob is created

---

## Scan Result Availability

* Malware scanning is asynchronous
* File Intake may wait up to five seconds after upload completion to check for a scan result.
* If no scan result has been recorded, the file is considered pending

Pending is determined by MalwareScanResult being null

---

## Upload Response Fields

The Upload API response includes:

* fileId
* message
* filePath
* filename
* hashValue
* malwareScanResult

---

## Upload Response Behavior

* If MalwareScanResult is null:
  * malwareScanResult is returned as Pending
* If MalwareScanResult has a value:
  * malwareScanResult is returned as the value stored in the database

---

## Malware Scan Result Values

MalwareScanResult may contain the following values returned by Defender:

* No Threat Found
* Malicious
* Error
* Not Scanned

If MalwareScanResult is null, the scan result is pending

---

## Batch Upload Behavior

* Each uploaded file is processed independently
* Each file has its own FileID, InternalUrl, and MalwareScanResult
* Scan results may complete at different times within a batch