Result model

A 200 response is terminal for the public transaction. It does not by itself mean that every applicable analysis area completed: always check completeness and warnings.

Public fields

Field	Meaning
analysis_id	Opaque identifier for the analysis
status	Always completed in public v1 success responses
verdict	phishing, suspicious, no_threat_detected, or inconclusive
risk	high, medium, none, or unknown
completeness	complete or partial
signal_codes	Bounded, generic public reasons
warnings	Accepted-input or incomplete-analysis conditions
created_at	UTC creation timestamp
schema_version	Public response schema version, currently 1.0
request_id	8–80 character correlation identifier for support

Security-preserving partiality

Situation	Public behavior
Confirmed threat and all applicable analysis completes	Preserve phishing or suspicious; complete
Confirmed threat and an applicable area is incomplete	Preserve the threat; partial plus the applicable warning
Apparently benign result and an applicable area is incomplete	inconclusive, unknown, partial, plus warning
An analysis area has no applicable input	Does not cause partiality by itself
Applicable timeout, error, unexpected absence, unknown state, or configuration skip	Causes partial
No usable analysis result	Safe RFC 9457 Problem, not a success object

Hermes does not label an incompletely analysed message as no_threat_detected.

Signal codes

• suspicious_link
• brand_impersonation
• unsafe_attachment
• suspicious_content
• suspicious_message

Warning codes

• malformed_message_accepted
• invalid_utf8_replaced
• analysis_completeness_unknown
• sender_authentication_incomplete
• content_analysis_incomplete
• link_analysis_incomplete
• attachment_analysis_incomplete

Input-format warnings can coexist with complete analysis. Incomplete-analysis warnings require partial.

Decision order

1. Verify the HTTP status and schema_version.
2. Read verdict and risk.
3. Check completeness and every warning.
4. Use signal_codes for explanation, routing, and observability.
5. Preserve analysis_id and request_id in redacted operational records.

The current success and Problem schemas use additionalProperties: false; fields outside the published schema are not part of this contract. Enum values are also closed. Treat an unknown field or enum as a contract mismatch until you review an updated OpenAPI document.

Human and policy controls still apply

Security classifications can contain false positives or false negatives. Do not describe any result as certainty, and handle partial results conservatively.