Events representing employee activity.
- Control rule removed
Account login method removed
Admin accepted invitation
Admin enabled MFA
Admin exported data
Admin loaded data
Admin logged in
Admin removed
Admin role updated
API key added
API key removed
App approval status updated
App labels added
App labels removed
App notes updated
App owner ID updated
App sensitivity level updated
Auto-licensing toggled
Auto-unlicensing configuration updated
Blocked URLs added
Blocked URLs removed
Blocked URLs URL schema obfuscation toggled
Browser extension enumeration toggled
Cloned login page detection ignored domains added
Cloned login page detection ignored domains removed
Control rule added
Control rule updated
Control rule toggled
Control rule reordered
Custom login URL added
Custom login URL removed
Data retention configuration updated
Detection archive status updated
Detection classification updated
Detection screenshots toggled
Domain enrichment toggled
Employees added to group
Employee disabled extension
Excluded extension domains added
Extended audit logging toggled
Excluded extension domains removed
Employee email updated
Employee name updated
Employee removed from group
Employees merged
Employees unmerged
Integration added
Integration completed
Integration removed
Label updated
Label removed
Leaked password check toggled
License assigned
License removed
Malicious copy paste detection ignored domains added
Malicious copy paste detection ignored domains removed
MFA tracking exclusions updated
Monitor all domains toggled
Monitored domains added
Monitored domains removed
Password protection URL masking toggled
Password protection ignore work apps toggled
Password protection ignored domains added
Password protection ignored domains removed
Phishing tool detection ignored domains added
Phishing tool detection ignored domains removed
Reused password exceptions updated
SAML SSO added
SAML SSO completed
SAML SSO default role updated
Session theft domains added
Session theft domains removed
Session theft marker rotated
Stolen credentials added
Stolen credentials removed
Stolen credentials mode updated
Unsupported app support requested
Unsupported app support request cancelled
URL block page updated
Weak password custom words added
Weak password custom words removed
Webhook added
Webhook removed
App banner configured
App banner enabled
MFA enforcement apps updated
MFA enforcement settings updated
Phishing tool detection page updated
Phishing tool detection mode updated
SSO password protection ignored domains added
SSO password protection ignored domains removed
SSO password protection ignore work apps toggled
SSO password protection mode updated
SSO password protection page updated
SSO password protection URL masking toggled
Control rule removed
Push Security Webhooks (v1)
Configure webhooks for the Push Security platform and receive real-time updates when events occur.
Each webhook event has the following:
- Versioning
- Idempotency key
- Metadata
- New and old objects to show exactly what has changed
- A signature for verifying sender authenticity
To create or manage your webhooks, go to the Settings page in the Push admin console.
Your endpoint has 5 seconds to respond with a 200 OK (or any other 2xx response). Otherwise, retry behavior will be triggered.
Each event will be sent a maximum of 4 times at the following time intervals:
- Immediately
- After 1 minute
- After 5 minutes
- After 15 minutes
If the event is acknowledged within a 5-second window, no more retries will be attempted.
Each retry of the event will have a newly generated X-Signature, but the event id will be the same for all retries.
The payload body is JSON-encoded and contains an idempotency key named id. If you want to ensure that you handle an event exactly once, please store this value and compare it against incoming events. This can be used to discard duplicate events that have been delivered more than once.
Each event has a header X-Signature which contains 2 parts:
- A UNIX timestamp value
t(in seconds) - An HMAC-SHA-256 value
v1which contains the payload signature to check using your webhook secret obtained at the time you created it
Here is an example of how it is formatted:
X-Signature: t=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CETo calculate and verify the signature, perform the following steps:
- Parse the
X-Signatureheader by splitting it first by,and then by=to obtain key-value pairs. - Store the
t(timestamp) andv1(signature) values in variables. - Concatenate the value of
t(as a string) with a.and the JSON request body (in its raw format). - Use the HMAC-SHA256 algorithm to compute the hash of the concatenated string.
- Compare the computed HMAC with the
v1value from the header to verify the signature. - Additionally, check the timestamp (
t) and compare it to the current time. If the difference is bigger than 35 mins (or your preferable threshold) you should discard the event to avoid replay attacks.
Example in Python:
import json
import hmac
import hashlib
import time
# Your secret key for the webhook
SECRET_KEY = b'psws_ad9d0bba8260baf774c3821acaff1b7d'
# Example header and request body (you would normally get these from the incoming HTTP request)
example_header = 't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE'
example_request_body = json.dumps({"key": "value"})
# Step 1: Parse the header
elements = example_header.split(',')
parsed_header = {}
for element in elements:
key, value = element.split('=')
parsed_header[key] = value
# Step 2: Store 't' and 'v1' values in variables
received_t = parsed_header.get('t')
received_v1 = parsed_header.get('v1')
# Step 3: Concatenate 't' value with '.' and the JSON request body
payload = f"{received_t}.{example_request_body}"
# Step 4: Compute the HMAC using SHA256
computed_hmac = hmac.new(SECRET_KEY, payload.encode(), hashlib.sha256).hexdigest().upper()
# Step 5: Compare the signature
is_valid = hmac.compare_digest(received_v1, computed_hmac)
# Step 6: Check the timestamp
current_time = int(time.time())
time_difference = current_time - int(received_t)
if time_difference > 2100: # 35 minutes
is_valid = False
message = "Timestamp is too old."
else:
message = "Signature verified" if is_valid else "Signature mismatch"
print(f"Is the signature valid? {is_valid}. Message: {message}")Example in Node.js:
const crypto = require('crypto');
// Your secret key for the webhook
const SECRET_KEY = 'psws_ad9d0bba8260baf774c3821acaff1b7d';
// Example header and request body (you'd normally get these from the incoming HTTP request)
const exampleHeader = 't=1698349494,v1=0E01666E58BC2E6C64E9A5DA66C28CF9D88C3E342CCFC029D56B749A4B4282CE';
const exampleRequestBody = JSON.stringify({ key: 'value' });
// Step 1: Parse the header
const elements = exampleHeader.split(',');
const parsedHeader = {};
elements.forEach((element) => {
const [key, value] = element.split('=');
parsedHeader[key] = value;
});
// Step 2: Store 't' and 'v1' values in variables
const receivedT = parsedHeader['t'];
const receivedV1 = parsedHeader['v1'];
// Step 3: Concatenate 't' value with '.' and the JSON request body
const payload = `${receivedT}.${exampleRequestBody}`;
// Step 4: Compute the HMAC using SHA256
const computedHmac = crypto.createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
// Step 5: Compare the signature
const isValid = crypto.timingSafeEqual(Buffer.from(receivedV1, 'hex'), Buffer.from(computedHmac, 'hex'));
// Step 6: Check the timestamp
const currentTime = Math.floor(Date.now() / 1000);
const timeDifference = currentTime - parseInt(receivedT, 10);
let message;
if (timeDifference > 2100) { // 35 minutes
isValid = false;
message = 'Timestamp is too old.';
} else {
message = isValid ? 'Signature verified' : 'Signature mismatch';
}
console.log(`Is the signature valid? ${isValid}. Message: ${message}`);
The payload body is JSON-encoded and contains a value named version. You're currently working with version 1 of the Push Security webhooks. Should there be any breaking changes in the future, we'll bump up this version number. If you have any webhooks configured, we'll send you notifications over email about the deprecation date for the older version.
Some SIEMs or other external systems where you may wish to send Push webhook events require a custom HTTP header for authorization. You can configure a custom header for webhooks in the Push admin console.
Go to Settings > Webhooks and add a new webhook. You will see a dropdown option for Custom headers.
Then enter a header key and value. Note that once your header key and value are entered, you will not be able to view them again, as they may contain secrets.
You may wish to send only specific types (or categories) of Push webhook events to your receiver. You can configure this when creating a new webhook in the Push admin console.
Go to Settings > Webhooks and add a new webhook. You will see a dropdown option for Select events.
Then you can select the specific events, or categories of events, to enable. If you select a category, any new events that are added to that category later (as part of new features released) will also be sent.
Download OpenAPI description
Overview
URL
support
License
Servers
https://api.pushsecurity.com/
Bodyapplication/json
The unique identifier for the event. This can be used as an idempotency key.
Example: "c478966c-f927-411c-b919-179832d3d50c"
When the event occurred, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
Example: "Control rule updated"
The description of the event. Note: this is subject to change and should not be used to match on this object.
Example: "user@example.com updated a control rule"
This object contains information about the user that performed the action triggering the audit log.
The current details of the updated rule.
The unique identifier for the rule
Example: "c478966c-f927-411c-b919-179832d3d50c"
The control that the rule applies to.
| Enum Value | Description |
|---|---|
| APP_BANNER | The App Banner control. |
| BLOCKED_URL | The Blocked URL control. |
| BROWSER_EXTENSION_BLOCKING | The Browser Extension Blocking control. |
| CLONED_LOGIN_PAGE_DETECTION | The Cloned Login Page Detection control. |
| MALICIOUS_COPY_PASTE_DETECTION | The Malicious Copy-Paste Detection control. |
| MFA_ENFORCEMENT | The MFA Enforcement control. |
| PASSWORD_PROTECTION | The Password Protection control. |
| PHISHING_TOOL_DETECTION | The Phishing Tool Detection control. |
| SESSION_TOKEN_THEFT_DETECTION | The Session Theft Detection control. |
| SSO_PASSWORD_PROTECTION | The SSO Password Protection control. |
The description given to the rule.
Example: "Display app banner on ChatGPT"
The criteria for applying the rule.
Conditions for matching app labels.
Conditions for matching employee groups.
Conditions for matching approval states.
Conditions for matching sensitivity levels.
Conditions for matching employee emails.
Conditions for matching employee identifiers.
Conditions for matching app types.
Conditions for matching arbitrary url patterns.
Conditions for matching specific browser extensions by ID.
Conditions for matching browser extensions by the permissions they use.
Conditions for matching specific browser extensions by the method of installation.
Conditions for matching specific browser extensions by the profile they are installed to.
When the rule was last updated, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
- https://api.pushsecurity.com/control-rule-updated
Bodyapplication/json
The unique identifier for the event. This can be used as an idempotency key.
Example: "c478966c-f927-411c-b919-179832d3d50c"
When the event occurred, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
Example: "Control rule removed"
The description of the event. Note: this is subject to change and should not be used to match on this object.
Example: "user@example.com removed a control rule"
This object contains information about the user that performed the action triggering the audit log.
The details of the removed rule.
The unique identifier for the rule
Example: "c478966c-f927-411c-b919-179832d3d50c"
The control that the rule applies to.
| Enum Value | Description |
|---|---|
| APP_BANNER | The App Banner control. |
| BLOCKED_URL | The Blocked URL control. |
| BROWSER_EXTENSION_BLOCKING | The Browser Extension Blocking control. |
| CLONED_LOGIN_PAGE_DETECTION | The Cloned Login Page Detection control. |
| MALICIOUS_COPY_PASTE_DETECTION | The Malicious Copy-Paste Detection control. |
| MFA_ENFORCEMENT | The MFA Enforcement control. |
| PASSWORD_PROTECTION | The Password Protection control. |
| PHISHING_TOOL_DETECTION | The Phishing Tool Detection control. |
| SESSION_TOKEN_THEFT_DETECTION | The Session Theft Detection control. |
| SSO_PASSWORD_PROTECTION | The SSO Password Protection control. |
The description given to the rule.
Example: "Display app banner on ChatGPT"
The criteria for applying the rule.
Conditions for matching app labels.
Conditions for matching employee groups.
Conditions for matching approval states.
Conditions for matching sensitivity levels.
Conditions for matching employee emails.
Conditions for matching employee identifiers.
Conditions for matching app types.
Conditions for matching arbitrary url patterns.
Conditions for matching specific browser extensions by ID.
Conditions for matching browser extensions by the permissions they use.
Conditions for matching specific browser extensions by the method of installation.
Conditions for matching specific browser extensions by the profile they are installed to.
When the rule was last updated, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
- https://api.pushsecurity.com/control-rule-removed
Bodyapplication/json
The unique identifier for the event. This can be used as an idempotency key.
Example: "c478966c-f927-411c-b919-179832d3d50c"
When the event occurred, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
Example: "Control rule toggled"
The description of the event. Note: this is subject to change and should not be used to match on this object.
Example: "user@example.com enabled/disabled a control rule"
This object contains information about the user that performed the action triggering the audit log.
The details of the enabled/disabled rule.
The unique identifier for the rule
Example: "c478966c-f927-411c-b919-179832d3d50c"
The control that the rule applies to.
| Enum Value | Description |
|---|---|
| APP_BANNER | The App Banner control. |
| BLOCKED_URL | The Blocked URL control. |
| BROWSER_EXTENSION_BLOCKING | The Browser Extension Blocking control. |
| CLONED_LOGIN_PAGE_DETECTION | The Cloned Login Page Detection control. |
| MALICIOUS_COPY_PASTE_DETECTION | The Malicious Copy-Paste Detection control. |
| MFA_ENFORCEMENT | The MFA Enforcement control. |
| PASSWORD_PROTECTION | The Password Protection control. |
| PHISHING_TOOL_DETECTION | The Phishing Tool Detection control. |
| SESSION_TOKEN_THEFT_DETECTION | The Session Theft Detection control. |
| SSO_PASSWORD_PROTECTION | The SSO Password Protection control. |
The description given to the rule.
Example: "Display app banner on ChatGPT"
The criteria for applying the rule.
Conditions for matching app labels.
Conditions for matching employee groups.
Conditions for matching approval states.
Conditions for matching sensitivity levels.
Conditions for matching employee emails.
Conditions for matching employee identifiers.
Conditions for matching app types.
Conditions for matching arbitrary url patterns.
Conditions for matching specific browser extensions by ID.
Conditions for matching browser extensions by the permissions they use.
Conditions for matching specific browser extensions by the method of installation.
Conditions for matching specific browser extensions by the profile they are installed to.
When the rule was last updated, formatted as a UNIX timestamp (in seconds).
Example: 1698604061
- https://api.pushsecurity.com/control-rule-toggled