# Retrieve the malicious browser extension detection configuration

Returns your organization's current malicious browser extension detection configuration, including the control-wide globals and every rule and its settings. Rules are returned in the order they're evaluated, with the highest-priority rule first.

Endpoint: GET /v1/controls/maliciousBrowserExtensionDetection/configuration
Version: v1
Security: x-api-key

## Security:

  - `x-api-key` (unknown)
    apiKey in header x-api-key

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `globals` (object, required)
    Control-wide settings that apply across every rule.

  - `globals.excludedExtensions` (array)
    Extensions excluded from malicious browser extension detection.
    Example: [{"extensionId":"abcdefghijklmnopabcdefghijklmnop","notes":"Approved by IT for the Finance team."}]

  - `globals.excludedExtensions.extensionId` (string, required)
    The extension to exclude, identified by its extension ID, such as a 32-character Chrome extension ID.
    Example: abcdefghijklmnopabcdefghijklmnop

  - `globals.excludedExtensions.notes` (string)
    Optional free-text notes explaining why the extension is excluded.
    Example: Approved by IT for the Finance team.

  - `rules` (array, required)
    Complete list of Malicious Browser Extension Detection rules.

  - `rules.id` (string)
    The rule's unique identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `rules.name` (string, required)
    A short name to help you recognise the rule.
    Example: Block high-severity extensions for Finance

  - `rules.enabled` (boolean, required)
    Whether the rule is active.
    Example: true

  - `rules.mode` (string, required)
    What happens to the browser extensions a rule matches.
    Enum: "OFF", "MONITOR", "BLOCK"

  - `rules.title` (string)
    Heading shown to the user when an extension is blocked. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: Extension blocked

  - `rules.subtext` (string)
    Message shown to the user when an extension is blocked. Markdown is supported. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: This extension is not permitted on company devices.

  - `rules.profileScope` (string)
    Match by the profile in use on the browser. If omitted, defaults to ALL.
    Enum: "ALL", "COMPANY_DOMAIN", "NON_COMPANY_DOMAIN"

  - `rules.criteria` (object)
    Restrict the rule to apply only under the specified conditions.

  - `rules.criteria.employeeIds` (object)
    Match specific employees by their employee identifier.
    Example: {"matches":["8c4f1d2e-9a0b-4c1d-8e2f-3a4b5c6d7e8f"]}

  - `rules.criteria.employeeIds.matches` (array, required)
    One or more values to match.

  - `rules.criteria.employeeIds.action` (string)
    Apply the rule to the matched values (INCLUDE) or to everything except them (EXCLUDE). Defaults to INCLUDE when omitted.
    Enum: "INCLUDE", "EXCLUDE"

  - `rules.criteria.employeeGroups` (object)
    Match employees by the groups they belong to.
    Example: {"matches":["Finance","Engineering"]}

  - `rules.criteria.browserExtensionSeverities` (object)
    Match extensions by the severity of the detection. One of LOW, MEDIUM, or HIGH.
    Example: {"matches":["HIGH","MEDIUM"]}

## Response 404:

  - `404` (unknown)
    Not Found