Retrieve Results from a Submitted Asynchronous DLP Content Inspection job

Retrieve the results of a previously submitted DLP content inspection job using the obtained job-id. This endpoint will be used to retrieve the results for both structured and unstructured jobs. This endpoint must be polled continuously for a result. Adhere to following restrictions:

• Minimum Polling frequency:
  If the file size is less than 1MB, polling should occur at most once every 100 milliseconds.
  If the file size is greater than 1MB, polling should occur at most once every 5 seconds.
• Maximum Polling frequency:
  The maximum polling interval should be 299 seconds.
  Maximum Wait Time: If more than 36 minutes elapses from the time the asynchronous inspection request was submitted, the cache entry would be cleared and a new inspection request will be required.

Request Endpoint

GET

https://<appliance_ip>/inspections/jobs/<job-id>

Call Example

curl -X 'GET' \
  'https://10.0.0.1/inspections/jobs/7e548ccf-c96e-4f5f-9f9e-4a468776972e' \
  -H 'accept: multipart/mixed' \
  -H 'x-netskope-generate-incidents: true'

Response Example

Retrieving Inspection Results (425 Too Early Error)
Once an asynchronously inspection request is submitted, the service return the associated JobId and begins processing the job in background. DLP processing takes some time depends on number of profiles and file size in the request. When client requests for the inspection result and if result is not available, service responds with HTTP 425 status code.

#200 Response

The request was successfully completed, and the results are provided in multiple multipart/mixed parts. The first part contains the inspection result in JSON format. Subsequent parts include forensic data for each inspection result, shared in binary format. This forensic data may include extracted text, entity rule matches, preview images, and/or original subfiles. Each forensic part is identified by a name that maps to a corresponding forensic entry in the inspection result.

HTTP/1.1 200 OK
Date: Wed, 27 Aug 2025 15:31:51 GMT
Content-Type: multipart/mixed; boundary=ded37e13d22bcff5fb0ddeb9547185cca478dbfe6b1847a7e6f4e758d043
Transfer-Encoding: chunked
Connection: keep-alive

--ded37e13d22bcff5fb0ddeb9547185cca478dbfe6b1847a7e6f4e758d043
Content-Disposition: form-data; name="result_data"
Content-Type: application/json

{"results":[{"forensics":{"entity_rule_matches":"erm_580078163378984695","extracted_text":"et_580078163378984695"},"matches":[{"action_threshold_met":true,"cached":false,"id":"580078163378984695","maximum_severity":"high","profile":"DLP_MASK","rules":[{"entity":{"entities_summary":[{"count":1,"entity":"Name_mask"}],"limit_reached":false,"matches_count":1,"score":8,"weighted":true},"name":"ccn_or_name_masking","severity":"high","type":"entity"}]}],"metadata":{"category":"Text","language":"ENGLISH","mime_type":"text/plain","name":"mask.txt","sha256":"cea5d77c801bb3a91233334344b472e437e467cc745d20d1e4d60f73d3e6818e","size":222,"subfile":false,"type":"Plain Text file"}}],"status":"success","summary":{"profiles":["DLP_MASK"],"severity":"high","transaction_id":"2219920255353353236","verdict":"hit","verdict_type":"full"}}
--ded37e13d22bcff5fb0ddeb9547185cca478dbfe6b1847a7e6f4e758d043
Content-Disposition: form-data; name="erm_580078163378984695"
Content-Type: application/octet-stream

[{"matches":[[{"end_offset":118,"entity":"Name_mask","prefix":"2. ","score":3,"start_offset":109,"suffix":"@company.com: ","text":"XXXX.XXXXX","type":"content"}]],"profile":"DLP_MASK","rule":"ccn_or_name_masking"}]
--ded37e13d22bcff5fb0ddeb9547185cca478dbfe6b1847a7e6f4e758d043
Content-Disposition: form-data; name="et_580078163378984695"
Content-Type: application/octet-stream

Please reorder this list of users in alphabetical order by last name:
1. john.doe@company.com: admin2024
2. XXXX.XXXXX@company.com: ccninfo

The request header x-netskope-generate-incidents is added so that users can specify their choice for generating alerts & incidents.

The response headers have also been created: x-netskope-incidents-posted. The response header reflect whether the alerts and incidents were posted to the management plane.

Valid Query Parameters are:

Name	In	Type	Required	Description
job_id	path	string	true	The job ID returned from the asynchronous inspection request.

Responses

Status	Meaning	Description	Schema
200	OK	The request was successfully completed, and the results are provided in multiple multipart/mixed parts. The first part contains the inspection result in JSON format. Subsequent parts include forensic data for each inspection result if requested previously, shared in binary format. This forensic data may include extracted text, entity rule matches, preview images, and/or original subfiles. Each forensic part is identified by a name that maps to a corresponding forensic entry in the inspection result. Forensics data will not show if the original request did not explicitly ask for forensics.	Inline
400	Bad Request	The request was invalid. The response contains the error that caused the request to be rejected, if available.	string
404	Not Found	The requested job-id was not found.	string
425	Unknown	The inspection is still in progress and the final results are not yet available. Action Required: Wait and Retry. The client must poll the results endpoint until a successful response (e.g., 200 OK) is received. Polling for result: To efficiently retrieve the result without overloading the system, the client must poll the result endpoint. Minimum Polling frequency: If file_size <= 1MB, polling should be >=100ms If file_size > 1MB, polling can be >=5 sec Maximum Polling frequency: The maximum polling interval should be 299 seconds. Maximum Wait Time: If more than 36 minutes elapses from the time the asynchronous inspection request was submitted, the cache entry would be cleared and a new inspection request will be required.	None
500	Internal Server Error	An error occurred while getting the result. The response contains the error that caused the request to be rejected, if available.	string
503	Service Unavailable	No resources are available to performing the request.	None

Response Schema

Status Code 200

Name	Type	Required	Restrictions	Description
» result_data		false	none	Contains the overall result of the inspection. This includes the status of the inspection and any matches produced as a result of the inspection.
»» status		true	none	Specifies the status of a scan request. success – The content was inspected successfully. timeout – The content inspection took too long and was timed out. error – An error occurred while performing the content inspection.
»» status_info	string	false	none	Additional information about the status. For example, if status is error, this field may be present to provide details about the error that occurred.
»» summary		false	none	none
»»» verdict	string	true	none	The verdict: hit or no_hit
»»» verdict_type	string	true	none	The verdict type: full or partial
»»» severity	string	false	none	The severity of the rule: none, low, medium, high, or critical
»»» profiles		true	none	A list of profiles to use during the scan. Profiles determine which DLP rules are used when searching for matches.
»»» transaction_id	string	true	none	The transaction ID for this match.
»» results	[object]	false	none	When a scan completes successfully (status is success) this field may be present. It contains an array of entries – one for each file/subfile in the content that was scanned. Only files/subfiles that had rule matches or could not be scanned because they were protected will show up here. Files that were scanned but did not meet one of these two conditions do not appear here.
»»» bypassed_profiles	[string]	false	none	Specifies the list of profiles from the request that were bypassed because the file being scanned was protected in some way. If this field is not present, no profiles were bypassed.
»»» metadata	object	true	none	Metadata about the inspected content.
»»»» subfile	boolean	true	none	If a container file is passed to DLP, the subfiles within it are also scanned. If this field is true the match is for a subfile. If this field is false, either the content passed to DLP was not a container or the match was on the container itself.
»»»» file_id	integer	false	none	The internal identifier of the file/subfile.
»»»» name	string	false	none	The name (e.g. file name), if any, of the inspected content.
»»»» size	integer(uint64)	false	none	The size in bytes of the file/subfile.
»»»» sha256	string	false	none	The SHA256 hash of the inspected content.
»»»» language	string	false	none	The detected language of the inspected content.
»»»» type	string	false	none	The detected type of the inspected content.
»»»» category	string	false	none	The detected category of the inspected content.
»»»» mime_type	string	false	none	The MIME type of the inspected content.
»»»» protection	object	false	none	The field is present when the content is protected in some way. The protection may include one or both of encryption and microsoft_aip.
»»»»» encryption	object	false	none	The content is encrypted. No match data can be produced for encrypted content.
»»»»»» file_typing	boolean	false	none	Encrypted content detected with file typing.
»»»»»» classification	boolean	false	none	Encrypted content detected with classification.
»»»»»» classification_score	number(double)	false	none	The score of encrypted content detected with classification.
»»»»» microsoft_aip	object	false	none	The content is Microsoft AIP protected. If the content can be unprotected it will be inspected and match data may be produced. If it cannot be unprotected match data cannot be produced.
»»»»»» status	string	true	none	The Microsoft AIP protection status: protected: The content could not be unprotected, and was not inspected. unsanctioned: The content was AIP protected outside of a known MIP infrastructure and therefore could not be unprotected and was not inspected. sanctioned: The content was AIP protected by a known MIP infrastructure. Such content may be uprotected and scanned. It also may have DRM labels extracted.
»»»» drm	object	false	none	The content is protected by a DRM system.
»»»»» labels	[object]	true	none	An array of DRM label objects that contain detailed DRM label information.
»»»»»» id	string	true	none	The id of the label.
»»»»»» name	string	true	none	The name of the label.
»»»»»» instance	string	true	none	The instance of the label.
»»»»»» vendor	string	true	none	The vendor of the label.
»»»»»» data_classification_label	string	true	none	The data classification label.
»»» matches	[object]	false	none	An array of match entry objects that contain detailed DLP match information.
»»»» id	string	false	none	The match identifier. If this is a cached match, this will be set to the id of the previous match. Otherwise this field is a new identifier that DLP will use to refer to the match if it is seen in the future. Furthermore, for a non-cached response there will be a corresponding extracted_text multipart/mixed part returned for this file and this value will be set in the name field of the Content-Disposition header for that part.
»»»» cached	boolean	true	none	If true this match was found in the DLP cache, meaning the content has already been scanned for this profile and thus was not scanned as part of this request. id is set to the id that was created when the content was scanned. Because of this, there will be no forensics associated with the match as forensic data is not stored in the DLP cache.
»»»» profile	any	true	none	none

allOf

Name	Type	Required	Restrictions	Description
»»»»» anonymous		false	none	The name of the profile.

and

Name	Type	Required	Restrictions	Description
»»»»» anonymous	any	false	none	The profile to which the matched rules are attached.

continued

Name	Type	Required	Restrictions	Description
»»»» action_threshold_met	boolean	true	none	If true, the action threshold was met indicating that the DLP Client should perform the action associated with this profile. If this field is false the action threshold was not met and the action associated with this profile should not be performed.
»»»» maximum_severity	string	false	none	The maximum severity of the matched rules.
»»»» rules	[object]	false	none	none
»»»»» name	string	true	none	The name of the rule.
»»»»» severity	string	true	none	The severity of the rule. One of: none, low medium, high, critical
»»»»» type	string	true	none	The type of the rule. One of: entity: A rule that matches when a specific entity is found. For these rule matches the entity subfields will be present. not_entity: A rule that matches when a specific entity is not found. For these rule matches the entity subfields will be present. file_filter: A file filter rule. classification A classification rule. fingerprint A fingerprint rule. For these rule matches the fingerprint subfields will be present. fingerprint_group: A fingerprint 2.0 group rule. For these rule matches the fingerprint_group subfields will be present. structured_classification: A structured classification rule. For these rule matches the structured_classification subfields will be present.
»»»»» entity	object	false	none	Contains details about the entity rule that matched. This field is present when type is entity or not_entity.
»»»»»» weighted	boolean	true	none	If true this rule is using the weighted score to determine the severity. If false, count is being used.
»»»»»» score	integer	true	none	The weighted score of the rule matches.
»»»»»» limit_reached	boolean	true	none	If true the maximum number of matches for this rule was reached. This means that some identified data was omitted from the results.
»»»»»» entities_summary		true	none	An array of the matched entities and the corresponding counts for those entities.
»»»»»»» entity	string	true	none	The name of the entity that resulted in a match.
»»»»»»» count	integer	true	none	The number of times the given entity was matched.
»»»»»»» data_type		false	none	General data type describing this entity.
»»»»»»» sensitivity_level		true	none	The sensitivity level of the rule hit. One of: not_sensitive low medium high critical
»»»»»» matches_count	integer	true	none	The count of entity rule matches.
»»»»»» sensitivity_level		true	none	The sensitivity level of the rule hit. One of: not_sensitive low medium high critical
»»»»»» unique_count	integer	false	none	The number of unique entries that matched the rule. This field is only present when the profile specifies that rules should be uniquely counted.
»»»»» structured_classification	object	false	none	Details of a matched classification type rule
»»»»»» entities_summary		true	none	An array of the matched entities and the corresponding counts for those entities.
»»»»»» matches_count	integer	true	none	The count of entity rule matches.
»»»»»» sensitivity_level		true	none	The sensitivity level of the rule hit. One of: not_sensitive low medium high critical
»»»»»» data_type		false	none	General data type describing this entity.
»»»»» fingerprint	object	false	none	This field is present when type is fingerprint.
»»»»»» classification	string	true	none	The classification that matched.
»»»»»» match	string	true	none	The file that matched.
»»»»»» score	integer	true	none	The score of the matched finterprint.
»»»»» fingerprint_group	object	false	none	This field is present when type is fingerprint_group.
»»»»»» match	string	true	none	The fingerprinted file that matched.
»»»»»» score	integer	true	none	The similarity score of matched fingerprinted file.
»»» forensics	object	false	none	none
»»»» extracted_text	string(string)	false	none	String identifier used to correlate the extracted text with its corresponding part in the multipart response
»»»» entity_rule_matches	string(string)	false	none	String identifier used to correlate the entity rule matches with its corresponding part in the multipart response.
»»»» preview_image	string(string)	false	none	String identifier used to correlate the preview image with its corresponding part in the multipart response.
»»»» original_subfile	string(string)	false	none	String identifier used to correlate the original subfile with its corresponding part in the multipart response.

Enumerated Values

Property	Value
InspectionStatus: status	success
	timeout
	error
verdict	hit
	no_hit
verdict_type	full
	partial
severity	none
	low
	medium
	high
	critical
MicrosoftAipProtectionStatus: status	protected
	unsanctioned
	sanctioned
severity	none
	low
	medium
	high
	critical
type	entity
	not_entity
	file_filter
	classification
	fingerprint
	fingerprint_group
	structured_classification
sensitivity_level	not_sensitive
	low
	medium
	high
	critical

This operation does not require authentication