# Replace the malicious browser extension detection configuration

Replaces your organization's malicious browser extension detection
configuration with the configuration you send. Any rule you don't include is
deleted, and `globals.excludedExtensions` replaces your entire
excluded-extension list — send the complete set you want to keep, or an
empty array to clear it.
A rule with an `id` updates the existing rule with that `id`. A rule without
an `id` is created. Rules are evaluated in the order you send them, and the
first rule that matches wins.
To change part of the configuration, retrieve it first, apply your changes,
and send the complete configuration back.

Endpoint: PUT /v1/controls/maliciousBrowserExtensionDetection/configuration
Version: v1
Security: x-api-key

## Request fields (application/json):

  - `globals` (object, required)
    Control-wide settings that apply across every rule.

  - `globals.excludedExtensions` (array)
    Extensions excluded from malicious browser extension detection.
    Example: [{"extensionId":"abcdefghijklmnopabcdefghijklmnop","notes":"Approved by IT for the Finance team."}]

  - `globals.excludedExtensions.extensionId` (string, required)
    The extension to exclude, identified by its extension ID, such as a 32-character Chrome extension ID.
    Example: abcdefghijklmnopabcdefghijklmnop

  - `globals.excludedExtensions.notes` (string)
    Optional free-text notes explaining why the extension is excluded.
    Example: Approved by IT for the Finance team.

  - `rules` (array, required)
    Complete list of Malicious Browser Extension Detection rules.

  - `rules.id` (string)
    The rule's unique identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `rules.name` (string, required)
    A short name to help you recognise the rule.
    Example: Block high-severity extensions for Finance

  - `rules.enabled` (boolean, required)
    Whether the rule is active.
    Example: true

  - `rules.mode` (string, required)
    What happens to the browser extensions a rule matches.
    Enum: "OFF", "MONITOR", "BLOCK"

  - `rules.title` (string)
    Heading shown to the user when an extension is blocked. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: Extension blocked

  - `rules.subtext` (string)
    Message shown to the user when an extension is blocked. Markdown is supported. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: This extension is not permitted on company devices.

  - `rules.profileScope` (string)
    Match by the profile in use on the browser. If omitted, defaults to ALL.
    Enum: "ALL", "COMPANY_DOMAIN", "NON_COMPANY_DOMAIN"

  - `rules.criteria` (object)
    Restrict the rule to apply only under the specified conditions.

  - `rules.criteria.employeeIds` (object)
    Match specific employees by their employee identifier.
    Example: {"matches":["8c4f1d2e-9a0b-4c1d-8e2f-3a4b5c6d7e8f"]}

  - `rules.criteria.employeeIds.matches` (array, required)
    One or more values to match.

  - `rules.criteria.employeeIds.action` (string)
    Apply the rule to the matched values (INCLUDE) or to everything except them (EXCLUDE). Defaults to INCLUDE when omitted.
    Enum: "INCLUDE", "EXCLUDE"

  - `rules.criteria.employeeGroups` (object)
    Match employees by the groups they belong to.
    Example: {"matches":["Finance","Engineering"]}

  - `rules.criteria.browserExtensionSeverities` (object)
    Match extensions by the severity of the detection. One of LOW, MEDIUM, or HIGH.
    Example: {"matches":["HIGH","MEDIUM"]}

## Response 200 fields (application/json):

  - `globals` (object, required)
    Control-wide settings that apply across every rule.

  - `globals.excludedExtensions` (array)
    Extensions excluded from malicious browser extension detection.
    Example: [{"extensionId":"abcdefghijklmnopabcdefghijklmnop","notes":"Approved by IT for the Finance team."}]

  - `globals.excludedExtensions.extensionId` (string, required)
    The extension to exclude, identified by its extension ID, such as a 32-character Chrome extension ID.
    Example: abcdefghijklmnopabcdefghijklmnop

  - `globals.excludedExtensions.notes` (string)
    Optional free-text notes explaining why the extension is excluded.
    Example: Approved by IT for the Finance team.

  - `rules` (array, required)
    Complete list of Malicious Browser Extension Detection rules.

  - `rules.id` (string)
    The rule's unique identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `rules.name` (string, required)
    A short name to help you recognise the rule.
    Example: Block high-severity extensions for Finance

  - `rules.enabled` (boolean, required)
    Whether the rule is active.
    Example: true

  - `rules.mode` (string, required)
    What happens to the browser extensions a rule matches.
    Enum: "OFF", "MONITOR", "BLOCK"

  - `rules.title` (string)
    Heading shown to the user when an extension is blocked. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: Extension blocked

  - `rules.subtext` (string)
    Message shown to the user when an extension is blocked. Markdown is supported. Required when mode is BLOCK, and must be omitted for MONITOR and OFF.
    Example: This extension is not permitted on company devices.

  - `rules.profileScope` (string)
    Match by the profile in use on the browser. If omitted, defaults to ALL.
    Enum: "ALL", "COMPANY_DOMAIN", "NON_COMPANY_DOMAIN"

  - `rules.criteria` (object)
    Restrict the rule to apply only under the specified conditions.

  - `rules.criteria.employeeIds` (object)
    Match specific employees by their employee identifier.
    Example: {"matches":["8c4f1d2e-9a0b-4c1d-8e2f-3a4b5c6d7e8f"]}

  - `rules.criteria.employeeIds.matches` (array, required)
    One or more values to match.

  - `rules.criteria.employeeIds.action` (string)
    Apply the rule to the matched values (INCLUDE) or to everything except them (EXCLUDE). Defaults to INCLUDE when omitted.
    Enum: "INCLUDE", "EXCLUDE"

  - `rules.criteria.employeeGroups` (object)
    Match employees by the groups they belong to.
    Example: {"matches":["Finance","Engineering"]}

  - `rules.criteria.browserExtensionSeverities` (object)
    Match extensions by the severity of the detection. One of LOW, MEDIUM, or HIGH.
    Example: {"matches":["HIGH","MEDIUM"]}