# Push Security Webhooks

## Overview

Configure webhooks for the Push Security platform and receive real-time updates when events occur.

Each webhook event has the following:
* Versioning
* Idempotency key
* Metadata
* New and old objects to show exactly what has changed
* A signature for verifying sender authenticity

## Creating webhooks

To create or manage your webhooks, go to the [Settings](https://console.pushsecurity.com/app/settings/webhooks) page in the Push admin console.

## Acknowledging an event

Your endpoint has 5 seconds to respond with a `200 OK` (or any other 2xx response). Otherwise, retry behavior will be triggered.

## Retry behavior

Each event will be sent a maximum of 4 times at the following time intervals:
* Immediately
* After 1 minute
* After 5 minutes
* After 15 minutes

If the event is acknowledged within a 5-second window, no more retries will be attempted.

Each retry of the event will have a newly generated `X-Signature`, but the event `id` will be the same for all retries.

## Handling duplicate events

The payload body is JSON-encoded and contains an idempotency key named `id`. If you want to ensure that you handle an event exactly once, please store this value and compare it against incoming events. This can be used to discard duplicate events that have been delivered more than once.

## Verifying signatures

Each event has a header `X-Signature` which contains 2 parts:
* A UNIX timestamp value `t` (in seconds)
* An HMAC-SHA-256 value `v1` which contains the payload signature to check using your webhook secret obtained at the time you created it

Here is an example of how it is formatted:
```
X-Signature: t=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE
```

To calculate and verify the signature, perform the following steps:
1. Parse the `X-Signature` header by splitting it first by `,` and then by `=` to obtain key-value pairs.
2. Store the `t` (timestamp) and `v1` (signature) values in variables.
3. Concatenate the value of `t` (as a string) with a `.` and the JSON request body (in its raw format).
4. Use the HMAC-SHA256 algorithm to compute the hash of the concatenated string.
5. Compare the computed HMAC with the `v1` value from the header to verify the signature.
6. Additionally, check the timestamp (`t`) and compare it to the current time. If the difference is bigger than 35 mins (or your preferable threshold) you should discard the event to avoid replay attacks.

Example in Python:

```py
import json
import hmac
import hashlib
import time

# Your secret key for the webhook
SECRET_KEY = b'psws_ad9d0bba8260baf774c3821acaff1b7d'

# Example header and request body (you would normally get these from the incoming HTTP request)
example_header = 't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE'
example_request_body = json.dumps({"key": "value"})

# Step 1: Parse the header
elements = example_header.split(',')
parsed_header = {}
for element in elements:
    key, value = element.split('=')
    parsed_header[key] = value

# Step 2: Store 't' and 'v1' values in variables
received_t = parsed_header.get('t')
received_v1 = parsed_header.get('v1')

# Step 3: Concatenate 't' value with '.' and the JSON request body
payload = f"{received_t}.{example_request_body}"

# Step 4: Compute the HMAC using SHA256
computed_hmac = hmac.new(SECRET_KEY, payload.encode(), hashlib.sha256).hexdigest().upper()

# Step 5: Compare the signature
is_valid = hmac.compare_digest(received_v1, computed_hmac)

# Step 6: Check the timestamp
current_time = int(time.time())
time_difference = current_time - int(received_t)
if time_difference > 2100:  # 35 minutes
    is_valid = False
    message = "Timestamp is too old."
else:
    message = "Signature verified" if is_valid else "Signature mismatch"

print(f"Is the signature valid? {is_valid}. Message: {message}")
```

Example in Node.js:

```js
const crypto = require('crypto');

// Your secret key for the webhook
const SECRET_KEY = 'psws_ad9d0bba8260baf774c3821acaff1b7d';

// Example header and request body (you'd normally get these from the incoming HTTP request)
const exampleHeader = 't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE';
const exampleRequestBody = JSON.stringify({ key: 'value' });

// Step 1: Parse the header
const elements = exampleHeader.split(',');
const parsedHeader = {};
elements.forEach((element) => {
  const [key, value] = element.split('=');
  parsedHeader[key] = value;
});

// Step 2: Store 't' and 'v1' values in variables
const receivedT = parsedHeader['t'];
const receivedV1 = parsedHeader['v1'];

// Step 3: Concatenate 't' value with '.' and the JSON request body
const payload = `${receivedT}.${exampleRequestBody}`;

// Step 4: Compute the HMAC using SHA256
const computedHmac = crypto.createHmac('sha256', SECRET_KEY).update(payload).digest('hex');

// Step 5: Compare the signature
const isValid = crypto.timingSafeEqual(Buffer.from(receivedV1, 'hex'), Buffer.from(computedHmac, 'hex'));

// Step 6: Check the timestamp
const currentTime = Math.floor(Date.now() / 1000);
const timeDifference = currentTime - parseInt(receivedT, 10);
let message;

if (timeDifference > 2100) {  // 35 minutes
  isValid = false;
  message = 'Timestamp is too old.';
} else {
  message = isValid ? 'Signature verified' : 'Signature mismatch';
}

console.log(`Is the signature valid? ${isValid}. Message: ${message}`);

```

## Versioning

The payload body is JSON-encoded and contains a value named `version`. You're currently working with version 1 of the Push Security webhooks. Should there be any breaking changes in the future, we'll bump up this version number. If you have any webhooks configured, we'll send you notifications over email about the deprecation date for the older version.

## Custom headers

Some SIEMs or other external systems where you may wish to send Push webhook events require a custom HTTP header for authorization. You can configure a custom header for webhooks in the Push admin console.

Go to **Settings** > **Webhooks** and add a new webhook. You will see a dropdown option for **Custom headers**.

Then enter a header key and value. Note that once your header key and value are entered, you will not be able to view them again, as they may contain secrets.

## Filtering events

You may wish to send only specific types (or categories) of Push webhook events to your receiver. You can configure this when creating a new webhook in the Push admin console.

Go to **Settings** > **Webhooks** and add a new webhook. You will see a dropdown option for **Select events**.

Then you can select the specific events, or categories of events, to enable. If you select a category, any new events that are added to that category later (as part of new features released) will also be sent.

## IP addresses

Push sends webhook events from three static IP addresses:

* 34.241.178.196
* 54.75.174.254
* 52.214.240.129

We recommend that you allowlist these addresses. **Note**: These addresses are within the AWS EC2 public IP range for `eu-west-1` that were used prior to March 2026. Existing customers do not need to update their allowlist unless they wish to narrow it to just these static IP addresses.


Version: v1
License: Commercial

## Servers

```
https://api.pushsecurity.com
```

## Security

### X-Signature

Signature verification

Type: http
Scheme: bearer

## Download OpenAPI description

 - [Push Security Webhooks](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/_bundle/webhooks-v1.yaml)

## Activity

 - [POST file-download](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/activity/file-download-event.md)
 - [POST file-upload](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/activity/file-upload-event.md)
 - [POST login](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/activity/login-event.md)
## Audit

 - [POST account-login-method-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/account-login-method-removed-event.md): A login method for an account has been removed
 - [POST admin-accepted-invitation](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-accepted-invitation-event.md): A new admin user has accepted the invitation.
 - [POST admin-enabled-mfa](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-enabled-mfa-event.md): An admin user has enabled MFA for their account.
 - [POST admin-exported-data](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-exported-data-event.md): An admin user has exported data.
 - [POST admin-loaded-data](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-loaded-data-event.md): An admin user has loaded data. Note: this event will only be emitted if extended admin audit logging is enabled. [Learn more](https://pushsecurity.com/help/audience/administrators/docs/administering-p
 - [POST admin-logged-in](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-logged-in-event.md): An admin user has logged in.
 - [POST admin-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-removed-event.md): An admin user has been removed.
 - [POST admin-role-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/admin-role-updated-event.md): An admin user has updated another user's role.
 - [POST api-key-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/api-key-added-event.md): An admin user has added a new API Key.
 - [POST api-key-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/api-key-removed-event.md): An admin user has removed an API Key.
 - [POST app-approval-status-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-approval-status-updated-event.md): The approval status of an app has been updated
 - [POST app-labels-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-labels-added-event.md): A set of labels has been added to one or more apps.
 - [POST app-labels-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-labels-removed-event.md): A set of labels has been removed from one or more apps.
 - [POST app-notes-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-notes-updated-event.md): The notes of an app have been updated
 - [POST app-owner-id-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-owner-id-updated-event.md): The owner ID of an app has been updated
 - [POST app-sensitivity-level-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-sensitivity-level-updated-event.md): The sensitivity level of an app has been updated
 - [POST auto-licensing-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/auto-licensing-toggled-event.md): An admin user has toggled the auto-licensing setting.
 - [POST automatic-unlicensing-configuration-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/automatic-unlicensing-configuration-updated-event.md): An admin user updated the automatic unlicensing configuration.
 - [POST blocked-urls-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/blocked-urls-added-event.md): A set of URLs has been added to the URL blocking configuration.
 - [POST blocked-urls-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/blocked-urls-removed-event.md): A set of URLs has been removed from the URL blocking configuration.
 - [POST blocked-urls-url-schema-obfuscation-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/blocked-urls-url-schema-obfuscation-toggled-event.md): The URL schema obfuscation setting for blocked URLs has been toggled.
 - [POST browser-extension-enumeration-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/browser-extension-enumeration-toggled-event.md): An admin user has enabled or disabled browser extension enumeration.
 - [POST clipboard-custom-regex-pattern-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/clipboard-custom-regex-pattern-added-event.md): An admin user has added a new clipboard custom regex pattern.
 - [POST clipboard-custom-regex-pattern-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/clipboard-blocking-regex-pattern-removed-event.md): An admin user has removed a clipboard blocking regex pattern.
 - [POST cloned-login-page-detection-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/cloned-login-page-detection-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the Cloned login page detection feature.
 - [POST cloned-login-page-detection-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/cloned-login-page-detection-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the Cloned login page detection feature.
 - [POST control-rule-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rule-added-event.md): An admin user has added a new control rule.
 - [POST control-rule-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rule-updated-event.md): An admin user has updated a control rule.
 - [POST control-rule-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rule-removed-event.md): An admin user has removed a control rule.
 - [POST control-rule-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rule-toggled-event.md): An admin user has enabled or disabled a control rule.
 - [POST control-rule-reordered](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rule-reordered-event.md): An admin user has reordered a new control rule.
 - [POST control-rules-updated-via-api](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/control-rules-updated-via-api-event.md): A control's configuration was updated via the controls API.
 - [POST custom-detection-created](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/custom-detection-created-event.md): An admin user has created a new custom detection.
 - [POST custom-detection-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/custom-detection-removed-event.md): An admin user has removed a custom detection.
 - [POST custom-detection-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/custom-detection-updated-event.md): An admin user has updated the configuration of a custom detection.
 - [POST custom-login-url-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/custom-login-url-added-event.md): A custom login URL has been added for an app.
 - [POST custom-login-url-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/custom-login-url-removed-event.md): A custom login URL has been removed for an app.
 - [POST data-retention-configuration-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/data-retention-configuration-updated-event.md): An admin user updated the data retention configuration.
 - [POST detection-archived](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/detection-archive-status-updated-event.md): The archive status of a detection has been updated
 - [POST detection-classification-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/detection-classification-updated-event.md): The classification of a detection has been updated
 - [POST detection-screenshots-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/detection-screenshots-toggled-event.md): An admin user has enabled or disabled detection screenshots.
 - [POST domain-category-blocking-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/domain-category-blocking-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the Domain category blocking feature.
 - [POST domain-category-blocking-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/domain-category-blocking-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the Domain category blocking feature.
 - [POST domain-enrichment-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/domain-enrichment-toggled-event.md): An admin user has enabled or disabled domain enrichment.
 - [POST employee-added-to-group](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employees-added-to-group-event.md): An admin user has added one or more employees to a group.
 - [POST employee-disabled-extension](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employee-disabled-extension-event.md): An employee has temporarily disabled the Push extension for a specific domain.
 - [POST excluded-extension-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/excluded-extension-domains-added-event.md): A set of domains have been added to the list of excluded browser extension domains to monitor.
 - [POST extended-audit-logs-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/extended-audit-logs-toggled-event.md): An admin user has enabled or disabled extended audit logging.
 - [POST excluded-extension-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/excluded-extension-domains-removed-event.md): A set of domains have been removed from the list of excluded browser extension domains to monitor.
 - [POST extension-branding-logo-uploaded](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/extension-branding-logo-uploaded-event.md): The browser extension banner branding logo has been uploaded
 - [POST extension-branding-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/extension-branding-updated-event.md): The browser extension banner branding has been updated
 - [POST employee-email-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employee-email-updated-event.md): An admin user has updated the primary email of an employee.
 - [POST employee-name-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employee-name-updated-event.md): An admin user has updated the first name and/or last name of an employee.
 - [POST employee-removed-from-group](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employee-removed-from-group-event.md): An admin user removed an employee from a group.
 - [POST employees-merged](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employees-merged-event.md): An admin user has merged a list of employees.
 - [POST employees-unmerged](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/employees-unmerged-event.md): An admin user has unmerged one of the emails of an employee into a new employee.
 - [POST integration-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/integration-added-event.md): A new integration has been added.
 - [POST integration-completed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/integration-completed-event.md): An integration has been successfully completed.
 - [POST integration-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/integration-removed-event.md): A integration has been removed.
 - [POST label-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/label-updated-event.md): A label has been updated.
 - [POST label-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/label-removed-event.md): A label has been removed.
 - [POST leaked-password-check-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/leaked-password-check-toggled-event.md): An admin user has toggled the leaked password check.
 - [POST license-assigned](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/license-assigned-event.md): One or more employees have been assigned a license.
 - [POST license-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/license-removed-event.md): The license has been removed from one or more employees.
 - [POST malicious-browser-extension-detection-excluded-extensions-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/malicious-browser-extension-detection-excluded-extensions-added-event.md): A set of extensions have been added to the list of excluded extensions for the malicious browser extension detection feature.
 - [POST malicious-browser-extension-detection-excluded-extensions-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/malicious-browser-extension-detection-excluded-extensions-removed-event.md): A set of extensions have been removed from the list of excluded extensions for the malicious browser extension detection feature.
 - [POST malicious-copy-paste-detection-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/malicious-copy-paste-detection-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the malicious copy and paste detection feature.
 - [POST malicious-copy-paste-detection-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/malicious-copy-paste-detection-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the malicious copy and paste detection feature.
 - [POST mfa-tracking-exclusions-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/mfa-tracking-exclusions-updated.md): The MFA tracking exclusions list has been updated
 - [POST monitor-all-domains-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/monitor-all-domains-toggled-event.md): An admin user has toggled the "Monitor all domains" setting.
 - [POST monitored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/monitored-domains-added-event.md): A set of domains have been added to the list of monitored company domains.
 - [POST monitored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/monitored-domains-removed-event.md): A set of domains have been removed from the list of monitored company domains.
 - [POST oauth-app-approval-status-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/oauth-app-approval-status-updated-event.md): The approval status of an OAuth app has been updated
 - [POST password-protection-hide-urls-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/password-protection-hide-urls-toggled-event.md): An admin user has toggled the password protection URL masking setting.
 - [POST password-protection-ignore-work-apps-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/password-protection-ignore-work-apps-toggled-event.md): An admin user has toggled the "Ignore work apps" setting of the password protection feature.
 - [POST password-protection-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/password-protection-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the password protection feature.
 - [POST password-protection-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/password-protection-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the password protection feature.
 - [POST phishing-tool-detection-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/phishing-tool-detection-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the Phishing tool detection feature.
 - [POST phishing-tool-detection-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/phishing-tool-detection-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the Phishing tool detection feature.
 - [POST reused-password-finding-exceptions-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/reused-password-exceptions-updated.md): The reused password exceptions list has been updated
 - [POST saml-sso-added-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/saml-sso-added-event.md): A SAML SSO connection has been added.
 - [POST saml-sso-completed-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/saml-sso-completed-event.md): A SAML SSO connection has been successfully setup and enabled.
 - [POST saml-sso-default-role-updated-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/saml-sso-default-role-updated-event.md): An admin updated the SAML SSO default role.
 - [POST session-theft-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/session-theft-domains-added-event.md): A set of domains have been added to the list of domains in which the session theft marker is injected.
 - [POST session-theft-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/session-theft-domains-removed-event.md): A set of domains have been removed from the list of domains in which the session theft marker is injected.
 - [POST session-theft-marker-rotated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/session-theft-marker-rotated-event.md): An admin user has rotated the session theft marker.
 - [POST stolen-credentials-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/stolen-credentials-added-event.md): A set of stolen credentials have been added.
 - [POST stolen-credentials-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/stolen-credentials-removed-event.md): A set of stolen credentials have been removed.
 - [POST stolen-credentials-mode-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/stolen-credentials-mode-updated-event.md): An admin user has updated the mode of the stolen credentials feature.
 - [POST telemetry-rule-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/telemetry-rule-added-event.md): An admin user has added a new telemetry rule.
 - [POST telemetry-rule-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/telemetry-rule-updated-event.md): An admin user has updated a telemetry rule.
 - [POST telemetry-rule-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/telemetry-rule-removed-event.md): An admin user has removed a telemetry rule.
 - [POST telemetry-rule-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/telemetry-rule-toggled-event.md): An admin user has enabled or disabled a telemetry rule.
 - [POST telemetry-rule-reordered](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/telemetry-rule-reordered-event.md): An admin user has reordered a new telemetry rule.
 - [POST unsupported-app-support-requested](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/unsupported-app-support-requested-event.md): Support for an unsupported app has been requested.
 - [POST unsupported-app-support-request-cancelled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/unsupported-app-support-request-cancelled-event.md): Support request for an unsupported app has been cancelled.
 - [POST url-block-page-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/url-block-page-updated-event.md): An admin user updated the contents of the page shown when access to a URL is blocked by the URL blocking control.
 - [POST weak-password-custom-words-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/weak-password-custom-words-added-event.md): An admin user has added custom words to the weak password check.
 - [POST weak-password-custom-words-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/weak-password-custom-words-removed-event.md): An admin user has removed custom words from the weak password check.
 - [POST webhook-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/webhook-added-event.md): An admin user has configured a new webhook URL.
 - [POST webhook-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/webhook-removed-event.md): An admin user has removed a webhook URL.
 - [POST app-banner-configured](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-banner-configured-event.md): An app banner was configured.
 - [POST app-banner-enabled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/app-banner-enabled-event.md): An app banner was enabled or disabled.
 - [POST mfa-enforcement-apps-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/mfa-enforcement-apps-updated-event.md): An admin user has updated which apps the MFA enforcement control is enabled for.
 - [POST mfa-enforcement-settings-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/mfa-enforcement-settings-updated-event.md): An admin user has updated the MFA enforcement control settings.
 - [POST phishing-tool-detection-page-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/phishing-tool-detection-page-updated-event.md): An admin user has updated the page settings of the Phishing tool detection feature.
 - [POST phishing-tool-detection-mode-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/phishing-tool-detection-mode-updated-event.md): An admin user has updated the mode of the Phishing tool detection feature.
 - [POST sso-password-protection-ignored-domains-added](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-ignored-domains-added-event.md): A set of domains have been added to the list of ignored domains for the SSO password protection feature.
 - [POST sso-password-protection-ignored-domains-removed](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-ignored-domains-removed-event.md): A set of domains have been removed from the list of ignored domains for the SSO password protection feature.
 - [POST sso-password-protection-ignore-work-apps-toggled](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-ignore-work-apps-toggled-event.md): An admin user has toggled the "Ignore work apps" setting of the SSO password protection feature.
 - [POST sso-password-protection-mode-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-mode-updated-event.md): An admin user has updated the mode of the SSO password protection feature.
 - [POST sso-password-protection-page-updated](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-page-updated-event.md): An admin user has updated the page settings of the SSO password protection feature.
 - [POST sso-password-protection-url-masking-toggled-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/audit/sso-password-protection-url-masking-toggled-event.md): An admin user has toggled the password protection URL masking setting.
## Controls

 - [POST app-banner](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/app-banner-event.md)
 - [POST blocked-url-visited](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/blocked-url-visited-event.md)
 - [POST browser-extension-state-enforcement-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/browser-extension-state-enforcement-event.md)
 - [POST clipboard-blocking-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/clipboard-blocking-event.md)
 - [POST cloned-login-page-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/cloned-login-page-detected-event.md)
 - [POST custom-detection-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/custom-detection-detected-event.md)
 - [POST domain-category-blocking-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/domain-category-blocking-event.md)
 - [POST file-download-blocking](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/file-download-blocking-event.md)
 - [POST file-upload-blocking](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/file-upload-blocking-event.md)
 - [POST malicious-browser-extension-detected-event](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/malicious-browser-extension-detected-event.md)
 - [POST malicious-copy-paste-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/malicious-copy-paste-detected-event.md)
 - [POST mfa-enforcement](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/mfa-enforcement-event.md)
 - [POST password-logging-prevention-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/password-logging-prevention-event.md)
 - [POST phishing-tool-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/phishing-tool-detected-event.md)
 - [POST protected-password-entered](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/protected-password-entered-event.md)
 - [POST stolen-credentials-detected](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/stolen-credentials-detected.md)
 - [POST strong-password-enforcement](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/strong-password-enforcement-event.md)
 - [POST phishing](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/controls/sso-password-used-event.md)
## Detections

 - [POST blocked-url-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/blocked-url-detection-event.md)
 - [POST custom-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/custom-detection-event.md)
 - [POST malicious-browser-extension-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/malicious-browser-extension-detection-event.md)
 - [POST malware-delivery-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/malware-delivery-detection-event.md)
 - [POST phishing-attack-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/phishing-detection-event.md)
 - [POST stolen-credentials-detection](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/detections/stolen-credentials-detection-event.md)
## Entities

 - [POST account](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/account-event.md)
 - [POST accounts_other](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/account-other-event.md)
 - [POST app](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/app-event.md)
 - [POST apps_other](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/app-other-event.md)
 - [POST browser](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/browser-event.md)
 - [POST browser-extension](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/browser-extension-event.md)
 - [POST employee](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/employee-event.md)
 - [POST finding](https://push-security-prd-ba8f0f76-a2d2-42f5-aea2-d421.redocly.app/help/audience/engineering/webhooks-v1/entities/finding-event.md)