{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "SharpMailserver Management & Transactional API Schema (v1.2.5)",
  "product": "SharpMailserver",
  "cli": "sharpmail-cli",
  "schemaEndpoint": "/api/admin/cli/schema",
  "transactionalSendEndpoint": "/api/v1/send",
  "models": {
    "TransactionalSendRequest (POST /api/v1/send)": {
      "category": "Transactional",
      "singleton": false,
      "primaryKey": "Idempotency-Key",
      "minimumRole": "User",
      "properties": {
        "from": { "type": "string", "access": "optional", "default": "Key senderAddress", "description": "Sender address. Automatically defaults to the key's bound senderAddress for Role=User keys." },
        "to": { "type": "string[]", "access": "required", "description": "Array of primary recipient email addresses (at least 1 required)." },
        "cc": { "type": "string[]", "access": "optional", "default": "[]", "description": "Optional carbon-copy recipients." },
        "bcc": { "type": "string[]", "access": "optional", "default": "[]", "description": "Optional blind carbon-copy recipients." },
        "replyTo": { "type": "string", "access": "optional", "description": "Optional Reply-To address." },
        "subject": { "type": "string", "access": "required", "description": "Email subject line (UTF-8)." },
        "textBody": { "type": "string", "access": "optional", "description": "Plain-text body (text/plain). At least one of textBody or htmlBody is required." },
        "htmlBody": { "type": "string", "access": "optional", "description": "HTML body (text/html). Supply alongside textBody for 10/10 deliverability." },
        "category": { "type": "string", "access": "optional", "default": "transactional", "enum": ["critical", "transactional", "notification", "marketing"], "description": "Selects queue priority, IP warming bypass, and recipient-provider quota bucket." },
        "overflowMode": { "type": "string", "access": "optional", "default": "DeferQueue", "enum": ["DeferQueue", "Reject429"], "description": "Behavior when destination provider hourly quota is reached (smooth queue pacing vs. HTTP 429 + Retry-After)." },
        "idempotencyKey": { "type": "string", "access": "optional", "default": "Header Idempotency-Key", "description": "Deterministic deduplication key (e.g. invoice ID) preventing duplicate sends within 24 hours." },
        "headers": { "type": "Record<string, string>", "access": "optional", "default": "{}", "description": "Custom RFC 5322 X-headers dictionary." },
        "attachments": { "type": "SendAttachmentDto[]", "access": "optional", "default": "[]", "description": "Array of { fileName: string, contentType: string, base64Content: string }." }
      }
    },
    "Tenant": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "slug",
      "minimumRole": "ServerAdmin",
      "properties": {
        "id": { "type": "guid", "access": "read-only", "default": "UUIDv7", "description": "Internal immutable UUIDv7 identifier." },
        "slug": { "type": "string", "access": "key", "description": "Unique URL-safe tenant key (e.g. \"default\", \"acme\")." },
        "name": { "type": "string", "access": "required", "description": "Human-readable organization display name." },
        "isActive": { "type": "boolean", "access": "optional", "default": "true", "description": "Enable or suspend tenant." },
        "maxDomains": { "type": "integer", "access": "optional", "default": "100", "description": "Maximum domains allowed in this tenant." },
        "maxPrincipals": { "type": "integer", "access": "optional", "default": "10000", "description": "Maximum accounts and distribution lists." },
        "quotaGb": { "type": "integer", "access": "optional", "default": "100", "description": "Tenant storage ceiling in GiB." },
        "outboundDailyLimit": { "type": "integer", "access": "optional", "default": "25000", "description": "Maximum outbound emails per day across the tenant." },
        "defaultLockMode": { "type": "string", "access": "optional", "default": "Normal", "enum": ["Normal", "Governance", "Compliance", "LegalHold"], "description": "Default GoBD WORM lock mode for newly created domains." },
        "defaultRetentionDays": { "type": "integer", "access": "optional", "default": "0", "description": "Default mandatory retention period in days (3650 = 10y GoBD)." },
        "createdAtUtc": { "type": "datetime", "access": "read-only", "description": "Creation timestamp in UTC." }
      }
    },
    "Domain": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "name",
      "minimumRole": "TenantAdmin",
      "properties": {
        "id": { "type": "guid", "access": "read-only", "default": "UUIDv7", "description": "Internal domain UUIDv7." },
        "name": { "type": "string", "access": "key", "description": "DNS domain name (e.g. \"muster-logistik.de\")." },
        "tenant": { "type": "string", "access": "optional", "default": "default", "description": "Owning tenant slug or GUID." },
        "isActive": { "type": "boolean", "access": "optional", "default": "true", "description": "Enable or pause domain." },
        "postmasterAddress": { "type": "string", "access": "optional", "default": "postmaster@<name>", "description": "RFC 5321 postmaster contact address." },
        "dkimSigningMode": { "type": "string", "access": "optional", "default": "Dual", "enum": ["Rsa2048", "Ed25519", "Dual"], "description": "Active DKIM signing mode (Dual signs with both RSA-2048 and Ed25519)." },
        "dkimRsaSelector": { "type": "string", "access": "optional", "default": "s2026", "description": "RSA-2048 DNS selector." },
        "dkimRsaDnsName": { "type": "string", "access": "read-only", "default": "s2026._domainkey.<name>", "description": "Computed RSA-2048 _domainkey FQDN." },
        "dkimEd25519Selector": { "type": "string", "access": "optional", "default": "ed2026", "description": "Ed25519 DNS selector." },
        "dkimEd25519DnsName": { "type": "string", "access": "read-only", "default": "ed2026._domainkey.<name>", "description": "Computed Ed25519 _domainkey FQDN." },
        "retentionLockMode": { "type": "string", "access": "optional", "default": "Normal", "enum": ["Normal", "Governance", "Compliance", "LegalHold"], "description": "GoBD WORM archive lock mode for this domain." },
        "retentionDays": { "type": "integer", "access": "optional", "default": "0", "description": "Mandatory retention duration in days (3650 = 10y GoBD)." },
        "quotaGb": { "type": "integer", "access": "optional", "default": "50", "description": "Domain storage ceiling in GiB." },
        "maxMessageSizeMb": { "type": "integer", "access": "optional", "default": "50", "description": "Maximum message size in MiB." },
        "maxAccounts": { "type": "integer", "access": "optional", "default": "1000", "description": "Maximum mailboxes in this domain." },
        "outboundDailyLimit": { "type": "integer", "access": "optional", "default": "5000", "description": "Daily outbound send limit for this domain." },
        "outboundHourlyLimit": { "type": "integer", "access": "optional", "default": "1000", "description": "Hourly outbound send limit for this domain." },
        "usePlusAddressing": { "type": "boolean", "access": "optional", "default": "true", "description": "Enables RFC 5233 plus-addressing (user+tag@domain)." },
        "createdAtUtc": { "type": "datetime", "access": "read-only", "description": "Creation timestamp in UTC." }
      }
    },
    "Account (Account/User & Account/List)": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "email",
      "minimumRole": "TenantAdmin",
      "properties": {
        "id": { "type": "guid", "access": "read-only", "default": "UUIDv7", "description": "Internal principal UUIDv7." },
        "@type": { "type": "string", "access": "optional", "default": "User", "enum": ["User", "List"], "description": "Account variant: User mailbox or List distribution group." },
        "email": { "type": "string", "access": "key", "description": "Primary email address of the mailbox or list." },
        "displayName": { "type": "string", "access": "optional", "default": "Lokalteil", "description": "Display name shown in Webmail, GAL, and From headers." },
        "password": { "type": "string", "access": "write-only", "description": "Plaintext password on create/update (immediately hashed with Argon2id)." },
        "role": { "type": "string", "access": "optional", "default": "User", "enum": ["User", "ComplianceAuditor", "TenantAdmin", "ServerAdmin"], "description": "Administrative RBAC role." },
        "isActive": { "type": "boolean", "access": "optional", "default": "true", "description": "Enable or suspend account." },
        "quotaMb": { "type": "integer", "access": "optional", "default": "5120", "description": "Mailbox storage quota in MiB (5120 = 5 GiB)." },
        "usedBytes": { "type": "long", "access": "read-only", "default": "0", "description": "Current mailbox storage usage in bytes." },
        "outboundDailyLimit": { "type": "integer", "access": "optional", "default": "500", "description": "Daily outbound message limit for this account." },
        "forwardAddress": { "type": "string", "access": "optional", "description": "Optional SRS-safe forwarding destination email." },
        "forwardKeepOriginal": { "type": "boolean", "access": "optional", "default": "true", "description": "Keep a local copy in INBOX when forwarding is active." },
        "vacationEnabled": { "type": "boolean", "access": "optional", "default": "false", "description": "Enable automatic out-of-office responder." },
        "vacationSubject": { "type": "string", "access": "optional", "description": "Out-of-office auto-reply subject." },
        "vacationBody": { "type": "string", "access": "write-only", "description": "Out-of-office auto-reply body text." },
        "twoFactorEnabled": { "type": "boolean", "access": "read-only", "default": "false", "description": "Indicates whether TOTP 2FA is active." },
        "members": { "type": "string[]", "access": "optional", "default": "[]", "description": "Member email addresses (for @type=\"List\")." },
        "createdAtUtc": { "type": "datetime", "access": "read-only", "description": "Creation timestamp in UTC." }
      }
    },
    "Alias": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "address",
      "minimumRole": "TenantAdmin",
      "properties": {
        "address": { "type": "string", "access": "key", "description": "The alias email address." },
        "target": { "type": "string", "access": "required", "description": "Target primary Account email address." },
        "principalId": { "type": "guid", "access": "read-only", "description": "Resolved target principal UUID." },
        "description": { "type": "string", "access": "optional", "default": "\"\"", "description": "Purpose note or external service label (also shown in Webmail composer)." },
        "isMasked": { "type": "boolean", "access": "optional", "default": "false", "description": "Marks the alias as a masked privacy alias." },
        "isEnabled": { "type": "boolean", "access": "optional", "default": "true", "description": "When false, mail to this alias is rejected without releasing the address." },
        "createdAtUtc": { "type": "datetime", "access": "read-only", "description": "Creation timestamp in UTC." }
      }
    },
    "ApiKey": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "id",
      "minimumRole": "TenantAdmin",
      "properties": {
        "id": { "type": "guid", "access": "read-only", "default": "UUIDv7", "description": "Unique key UUID (used to revoke via DELETE)." },
        "apiKey": { "type": "string", "access": "create-only", "default": "smk_<id>_<secret>", "description": "Full Bearer token returned ONLY once upon creation." },
        "label": { "type": "string", "access": "required", "description": "Human-readable label (e.g. \"Ansible GitOps\" or \"Shopware 6\")." },
        "role": { "type": "string", "access": "optional", "default": "TenantAdmin", "enum": ["User", "ComplianceAuditor", "TenantAdmin", "ServerAdmin"], "description": "Privilege scope (User is strictly restricted to POST /api/v1/send)." },
        "senderAddress": { "type": "string", "access": "optional", "description": "Authorized sender address (required when role=\"User\")." },
        "defaultCategory": { "type": "string", "access": "optional", "default": "transactional", "enum": ["critical", "transactional", "notification", "marketing"], "description": "Default send category for this key." },
        "allowedCidrs": { "type": "string[]", "access": "optional", "default": "[] (Alle IPs)", "description": "Allowed source IPv4/IPv6 CIDR networks." },
        "expiresInDays": { "type": "integer", "access": "write-only", "default": "null (Kein Ablauf)", "description": "Optional automatic expiration in days from creation." },
        "expiresAtUtc": { "type": "datetime", "access": "read-only", "description": "Computed UTC expiration timestamp." },
        "outboundDailyLimit": { "type": "integer", "access": "optional", "default": "10000", "description": "Daily outbound send limit for this key." },
        "isActive": { "type": "boolean", "access": "read-only", "default": "true", "description": "Active status." }
      }
    },
    "Route": {
      "category": "Collection",
      "singleton": false,
      "primaryKey": "domain",
      "minimumRole": "ServerAdmin",
      "properties": {
        "domain": { "type": "string", "access": "key", "description": "Destination recipient domain (e.g. \"neff.me\" or \"*.partner-holding.eu\")." },
        "targetHost": { "type": "string", "access": "optional", "default": "\"\" (Auto DNS-MX)", "description": "Relay hostname or IP. Leave empty to resolve the destination MX via DNS automatically." },
        "targetPort": { "type": "integer", "access": "optional", "default": "25", "description": "Destination TCP port (25, 587, or 465)." },
        "tlsMode": { "type": "string", "access": "optional", "default": "StartTlsOptional", "enum": ["StartTlsOptional", "StartTlsRequired", "StartTlsIgnoreCert", "ImplicitTls", "ImplicitTlsIgnoreCert", "None"], "description": "Outbound TLS and X.509 validation mode for this domain." },
        "username": { "type": "string", "access": "optional", "description": "Optional SMTP AUTH username." },
        "password": { "type": "string", "access": "write-only", "description": "Optional SMTP AUTH password." },
        "hasPassword": { "type": "boolean", "access": "read-only", "default": "false", "description": "Indicates whether a password is stored." },
        "clearPassword": { "type": "boolean", "access": "write-only", "default": "false", "description": "Set true to clear stored password." },
        "description": { "type": "string", "access": "optional", "description": "Admin audit note." },
        "enabled": { "type": "boolean", "access": "optional", "default": "true", "description": "Enable or pause route." }
      }
    },
    "TransactionalSend (Singleton)": {
      "category": "Singleton",
      "singleton": true,
      "primaryKey": "singleton",
      "minimumRole": "TenantAdmin",
      "properties": {
        "enabled": { "type": "boolean", "access": "optional", "default": "true", "description": "Enables category and provider quota governance." },
        "warmingEnabled": { "type": "boolean", "access": "optional", "default": "false", "description": "Enables progressive daily IP warming ramp." },
        "startAtWarmingDay": { "type": "integer", "access": "write-only", "default": "1", "description": "Jumps or resets warming schedule to day N (1..365)." },
        "currentWarmingDay": { "type": "integer", "access": "read-only", "description": "Current active day in warming schedule." },
        "currentWarmingPercent": { "type": "integer", "access": "read-only", "description": "Current active percentage of target provider quotas." },
        "warmingDailyRampPercents": { "type": "integer[]", "access": "optional", "default": "[5,7,10,...,100]", "description": "Daily percentage array for the warming ramp." },
        "maxDeferHours": { "type": "integer", "access": "optional", "default": "48", "description": "Maximum lookahead window in hours for DeferQueue pacing." },
        "defaultCategory": { "type": "string", "access": "optional", "default": "transactional", "enum": ["critical", "transactional", "notification", "marketing"], "description": "Fallback category when omitted in API calls." },
        "preset": { "type": "string", "access": "write-only", "enum": ["warming_28d", "warming_14d", "production_100"], "description": "One-step preset selector." },
        "categories": { "type": "CategoryPolicy[]", "access": "optional", "default": "4 Kategorien", "description": "Array of category policy objects." },
        "providers": { "type": "ProviderQuota[]", "access": "optional", "default": "6 Provider-Gruppen", "description": "Array of recipient-provider quota definitions." }
      }
    },
    "ReputationShield (Singleton)": {
      "category": "Singleton",
      "singleton": true,
      "primaryKey": "singleton",
      "minimumRole": "TenantAdmin",
      "properties": {
        "preset": { "type": "string", "access": "write-only", "enum": ["off", "recommended", "strict_bulk"], "description": "Applies a complete protection profile in one step." },
        "enableSuppressionPreCheck": { "type": "boolean", "access": "optional", "default": "false", "description": "Filters suppressed addresses pre-send." },
        "enforceSuppressionOnSmtpRelay": { "type": "boolean", "access": "optional", "default": "false", "description": "Also enforces suppression list on SMTP submission." },
        "allSuppressedBehavior": { "type": "string", "access": "optional", "default": "reject_422", "enum": ["reject_422", "accept_noop"], "description": "Response mode when all recipients are suppressed." },
        "autoSuppressHardBounces": { "type": "boolean", "access": "optional", "default": "false", "description": "Automatically suppresses 5xx permanent hard bounces." },
        "hardBounceSuppressionDays": { "type": "integer", "access": "optional", "default": "180", "description": "Retention days for hard-bounce suppressions." },
        "autoSuppressConsecutiveSoftBounces": { "type": "boolean", "access": "optional", "default": "false", "description": "Escalates repeated 4xx soft bounces to suppression list." },
        "softBounceEscalationThreshold": { "type": "integer", "access": "optional", "default": "5", "description": "Consecutive soft bounces before suppression." },
        "autoSuppressFblComplaints": { "type": "boolean", "access": "optional", "default": "false", "description": "Parses inbound RFC 5965 ARF abuse reports automatically." },
        "enableOneClickUnsubscribe": { "type": "boolean", "access": "optional", "default": "false", "description": "Injects DKIM-signed RFC 8058 List-Unsubscribe headers." },
        "oneClickUnsubscribeCategories": { "type": "string[]", "access": "optional", "default": "[\"marketing\",\"notification\"]", "description": "Categories receiving RFC 8058 unsubscribe headers." },
        "enableBounceCircuitBreaker": { "type": "boolean", "access": "optional", "default": "false", "description": "Pauses non-critical sends if 24h bounce/complaint rate spikes." },
        "maxHardBouncePercent": { "type": "number", "access": "optional", "default": "5.0", "description": "24h hard-bounce rate ceiling in percent." },
        "maxComplaintPercent": { "type": "number", "access": "optional", "default": "0.1", "description": "24h ARF complaint rate ceiling in percent." },
        "allowCriticalWhenTripped": { "type": "boolean", "access": "optional", "default": "true", "description": "Allows critical 2FA mail even when circuit breaker is tripped." },
        "enableAdaptiveIspBackoff": { "type": "boolean", "access": "optional", "default": "false", "description": "Automatic cooldown when remote MX returns 421/451 throttling." },
        "ispCooldownMinutes": { "type": "integer", "access": "optional", "default": "15", "description": "Cooldown duration in minutes." },
        "webhookEnabled": { "type": "boolean", "access": "optional", "default": "false", "description": "Enables HMAC-SHA256 signed webhooks." },
        "webhookUrl": { "type": "string", "access": "optional", "description": "Destination HTTPS URL for webhooks." },
        "webhookSecret": { "type": "string", "access": "write-only", "description": "HMAC-SHA256 secret for X-SharpMail-Signature." }
      }
    },
    "SpamGuard (Singleton)": {
      "category": "Singleton",
      "singleton": true,
      "primaryKey": "singleton",
      "minimumRole": "ServerAdmin",
      "properties": {
        "enableEmailAuthChecks": { "type": "boolean", "access": "optional", "default": "true", "description": "Verifies inbound SPF, DKIM, DMARC, and ARC." },
        "enableGreylisting": { "type": "boolean", "access": "optional", "default": "true", "description": "Adaptive Smart Greylisting for unknown first-time senders." },
        "greylistRetryDelaySeconds": { "type": "integer", "access": "optional", "default": "240", "description": "Minimum retry delay in seconds (default: 240s)." },
        "junkScoreThreshold": { "type": "number", "access": "optional", "default": "4.5", "description": "Score threshold for filing into the Junk folder." },
        "rejectScoreThreshold": { "type": "number", "access": "optional", "default": "9.0", "description": "Score threshold for hard SMTP 550 rejection." },
        "tagSubjectOnJunk": { "type": "boolean", "access": "optional", "default": "false", "description": "Prepend subject prefix to Junk messages." },
        "subjectTagPrefix": { "type": "string", "access": "optional", "default": "\"[SPAM] \"", "description": "Subject prefix string." },
        "enableStructuralHeuristics": { "type": "boolean", "access": "optional", "default": "true", "description": "Evaluates MIME/HTML structural heuristics." },
        "dnsblZones": { "type": "string[]", "access": "optional", "default": "[\"bl.spamcop.net\",\"ix.dnsbl.manitu.net\"]", "description": "Queried DNSBL zones." },
        "dnsblHitScore": { "type": "number", "access": "optional", "default": "3.5", "description": "Score added per DNSBL hit." },
        "allowedSendersOrDomains": { "type": "string[]", "access": "optional", "default": "[]", "description": "Explicit sender email or domain allowlist." },
        "blockedSendersOrDomains": { "type": "string[]", "access": "optional", "default": "[]", "description": "Explicit sender email or domain blocklist." },
        "clamAvEnabled": { "type": "boolean", "access": "optional", "default": "false", "description": "Enables ClamAV daemon TCP INSTREAM scanning." },
        "clamAvHost": { "type": "string", "access": "optional", "default": "\"127.0.0.1\"", "description": "ClamAV daemon host or IP." },
        "clamAvPort": { "type": "integer", "access": "optional", "default": "3310", "description": "ClamAV daemon TCP port." }
      }
    },
    "SmtpQueue (Singleton)": {
      "category": "Singleton",
      "singleton": true,
      "primaryKey": "singleton",
      "minimumRole": "ServerAdmin",
      "properties": {
        "outboundQueuePaused": { "type": "boolean", "access": "optional", "default": "false", "description": "Pauses outbound MX delivery while continuing to accept mail." },
        "outboundWorkerConcurrency": { "type": "integer", "access": "optional", "default": "8", "description": "Number of parallel outbound delivery workers." },
        "maxDeliveryAttempts": { "type": "integer", "access": "optional", "default": "10", "description": "Maximum delivery attempts before permanent bounce." },
        "retryScheduleMinutes": { "type": "integer[]", "access": "optional", "default": "[5,15,60,240,720]", "description": "Retry backoff schedule in minutes." },
        "maxConcurrentConnectionsPerMxDomain": { "type": "integer", "access": "optional", "default": "4", "description": "Max concurrent connections per destination MX domain." },
        "strictThrottleDomains": { "type": "string[]", "access": "optional", "default": "[\"t-online.de\",\"gmx.de\",\"web.de\",\"yahoo.com\"]", "description": "Domains subject to strict concurrency throttling." },
        "strictThrottleMaxConcurrency": { "type": "integer", "access": "optional", "default": "2", "description": "Max concurrent connections for strictThrottleDomains." },
        "outboundConnectTimeoutSeconds": { "type": "integer", "access": "optional", "default": "30", "description": "Outbound TCP/TLS connect timeout in seconds." },
        "outboundBindAddress": { "type": "string", "access": "optional", "default": "\"\" (Auto)", "description": "Optional local source IP bind address." },
        "outboundUseStartTls": { "type": "boolean", "access": "optional", "default": "true", "description": "Use STARTTLS on outbound MX connections." },
        "requireOutboundTls": { "type": "boolean", "access": "optional", "default": "false", "description": "Abort delivery if remote MX does not offer TLS." },
        "outboundTlsCertValidation": { "type": "string", "access": "optional", "default": "Opportunistic", "enum": ["Opportunistic", "IgnoreErrors", "Strict"], "description": "Global outbound X.509 certificate validation mode." },
        "outboundSmartHost": { "type": "string", "access": "optional", "default": "\"\"", "description": "Optional global upstream relay host." },
        "outboundSmartPort": { "type": "integer", "access": "optional", "default": "587", "description": "Global smart-host TCP port." },
        "maxMessageSizeMb": { "type": "long", "access": "optional", "default": "50", "description": "Global ESMTP SIZE limit in MiB." },
        "maxRecipientsPerTransaction": { "type": "integer", "access": "optional", "default": "100", "description": "Maximum RCPT TO commands per transaction." },
        "maxConnectionsPerIp": { "type": "integer", "access": "optional", "default": "20", "description": "Maximum simultaneous inbound connections per IP." },
        "tarpitDelayMs": { "type": "integer", "access": "optional", "default": "1500", "description": "Tarpit delay in ms on auth/command errors." },
        "requireTlsForAuth": { "type": "boolean", "access": "optional", "default": "true", "description": "Requires TLS encryption before allowing SMTP AUTH." }
      }
    },
    "TransportRules & Server (Singletons)": {
      "category": "Singleton",
      "singleton": true,
      "primaryKey": "singleton",
      "minimumRole": "ServerAdmin",
      "properties": {
        "outboundDisclaimerEnabled": { "type": "boolean", "access": "optional", "default": "false", "description": "Appends mandatory corporate footer to outbound messages." },
        "outboundDisclaimerExternalOnly": { "type": "boolean", "access": "optional", "default": "true", "description": "Append footer only when sending to external domains." },
        "outboundDisclaimerText": { "type": "string", "access": "optional", "default": "\"\"", "description": "Plain-text legal footer." },
        "outboundDisclaimerHtml": { "type": "string", "access": "optional", "default": "\"\"", "description": "HTML legal footer." },
        "inboundSystemSieve": { "type": "string", "access": "optional", "default": "\"\"", "description": "Global RFC 5228 Sieve script executed before user scripts." },
        "autoBanThreshold": { "type": "integer", "access": "optional", "default": "8", "description": "Failed logins before automatic IP ban." },
        "autoBanDurationMinutes": { "type": "integer", "access": "optional", "default": "30", "description": "Automatic IP ban duration in minutes." },
        "serverHostName": { "type": "string", "access": "optional", "default": "mail.<domain>", "description": "Canonical EHLO, TLS, and Autodiscover FQDN (Object: Server)." },
        "storageProvider": { "type": "string", "access": "read-only", "default": "Sqlite | SqlServer | Postgres", "description": "Active storage engine (Object: Server)." },
        "activeQueueCount": { "type": "integer", "access": "read-only", "default": "0", "description": "Current outbound queue count (Object: Server)." },
        "licenseState": { "type": "string", "access": "read-only", "default": "EnterpriseActive", "description": "License state (Object: Server)." }
      }
    }
  }
}