Skip to content
/
Control rule removed

Control rule removed
Webhook

Request

An admin user has removed a control rule.

Security
X-Signature
Headers
X-Signaturestringrequired
Example:X-Signature: t=1492774577,v1=5257a869...
Bodyapplication/json
versionstringrequired

The version of the event.

Example:"1"
idstring, (uuid)required

The unique identifier for the event. This can be used as an idempotency key.

Example:"c478966c-f927-411c-b919-179832d3d50c"
tenantIdstring, (uuid)required

The unique identifier of the tenant the event belongs to.

Example:"4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a"
timestampintegerrequired

When the event occurred, formatted as a UNIX timestamp (in seconds).

Example:1698604061
categorystringrequired

The category of the event.

Value:"AUDIT"
objectstringrequired

The type of event.

Value:"CONTROL_RULE_REMOVED"
friendlyNamestringrequired

The friendly name of this object. Note: this is subject to change and should not be used to match on this object.

Example:"Control rule removed"
descriptionstringrequired

The description of the event. Note: this is subject to change and should not be used to match on this object.

Example:"user@example.com removed a control rule"
actorobject(Admin Audit Log Actor)required

This object contains information about the user that performed the action triggering the audit log.

newobject(Control Rule)required

The details of the removed rule.

tenantMetadataobject(Tenant Metadata)

Key/value metadata set by the partner that manages this tenant. Only present for tenants managed by a partner. When a partner manages the tenant but has set no metadata, it is present as an empty object rather than omitted or null. A partner may set at most 10 entries, with keys up to 40 characters and values up to 256 characters.

Example:
{
  "customerRef": "ACME-001",
  "region": "emea"
}
POST
control-rule-removed
Payload
{
  "version": "1",
  "id": "c478966c-f927-411c-b919-179832d3d50c",
  "tenantId": "4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a",
  "tenantMetadata": {
    "customerRef": "ACME-001",
    "region": "emea"
  },
  "timestamp": 1698604061,
  "category": "AUDIT",
  "object": "CONTROL_RULE_REMOVED",
  "friendlyName": "Control rule removed",
  "description": "user@example.com removed a control rule",
  "actor": {
    "source": "UI",
    "email": "string",
    "sourceIpAddress": "string",
    "userAgent": "string",
    "role": "OWNER"
  },
  "new": {
    "ruleId": "c478966c-f927-411c-b919-179832d3d50c",
    "control": "APP_BANNER",
    "description": "Display app banner on ChatGPT",
    "enabled": true,
    "criteria": {
      "appLabels": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "employeeGroups": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "approvalStates": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "sensitivityLevels": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "employeeEmails": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "employeeIds": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "appTypes": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "urlPatterns": {
        "patterns": [
          "*://example.com/*"
        ]
      },
      "browserExtensionIds": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "browserExtensionPermissions": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "browserExtensionDeploymentType": {
        "patterns": [
          "string"
        ],
        "include": true
      },
      "browserExtensionProfile": {
        "patterns": [
          "string"
        ],
        "include": true
      }
    },
    "settings": {},
    "lastUpdatedTimestamp": 1698604061
  }
}

Responses

Return any 2XX status to indicate that the data was received successfully