Skip to content
/
Control rules updated via...

Control rules updated via API
Webhook

Request

A control's configuration was updated via the controls API.

Security
X-Signature
Headers
X-Signaturestringrequired
Example:X-Signature: t=1492774577,v1=5257a869...
Bodyapplication/json
versionstringrequired

The version of the event.

Example:"1"
idstring, (uuid)required

The unique identifier for the event. This can be used as an idempotency key.

Example:"c478966c-f927-411c-b919-179832d3d50c"
timestampintegerrequired

When the event occurred, formatted as a UNIX timestamp (in seconds).

Example:1698604061
categorystringrequired

The category of the event.

Value:"AUDIT"
objectstringrequired

The type of event.

Value:"CONTROL_RULES_UPDATED_VIA_API"
friendlyNamestringrequired

The friendly name of this object. Note: this is subject to change and should not be used to match on this object.

Example:"Control rules updated via API"
descriptionstringrequired

The description of the event. Note: this is subject to change and should not be used to match on this object.

Example:"API key (SIEM integration key) updated the file download telemetry configuration"
actorobject(Admin Audit Log Actor API)required

This object contains details about the API key used in the API request that triggered the audit log.

newobjectrequired

The full configuration for the control after the update, in the same shape returned by the controls API.

oldobjectrequired

The full configuration for the control before the update, in the same shape returned by the controls API.

POST
control-rules-updated-via-api
Payload
{
  "version": "1",
  "id": "c478966c-f927-411c-b919-179832d3d50c",
  "timestamp": 1698604061,
  "category": "AUDIT",
  "object": "CONTROL_RULES_UPDATED_VIA_API",
  "friendlyName": "Control rules updated via API",
  "description": "API key (SIEM integration key) updated the file download telemetry configuration",
  "actor": {
    "source": "API",
    "apiKeyName": "string",
    "apiKeyCreatedBy": "string",
    "sourceIpAddress": "string",
    "userAgent": "string"
  },
  "new": {},
  "old": {}
}

Responses

Return any 2XX status to indicate that the data was received successfully