# MailPhishing

- [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing#SCHEMA_REPRESENTATION)

Proto for all phishing alerts with common payload. Supported types are any of the following:

- User reported phishing
- User reported spam spike
- Suspicious message reported
- Phishing reclassification
- Malware reclassification
- Gmail potential employee spoofing

| JSON representation |
|---|
| ``` { "domainId": { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DomainId`) }, "maliciousEntity": { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity`) }, "messages": [ { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/GmailMessageInfo`) } ], "isInternal": boolean, "systemActionType": enum (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SystemActionType`) } ``` |

| Fields ||
|---|---|
| `domainId` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DomainId`)`` The domain ID. |
| `maliciousEntity` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity`)`` The entity whose actions triggered a Gmail phishing alert. |
| `messages[]` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/GmailMessageInfo`)`` The list of messages contained by this alert. |
| `isInternal` | `boolean` If `true`, the email originated from within the organization. |
| `systemActionType` | ``enum (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SystemActionType`)`` System actions on the messages. |