# Clipboard blocking

Endpoint: POST clipboard-blocking-event
Version: v1
Security: X-Signature

## Header parameters:

  - `X-Signature` (string, required)

## Request fields (application/json):

  - `version` (string)
    The version of the event.
    Example: 1

  - `id` (string)
    The unique identifier for the event. This can be used as an idempotency key.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `tenantId` (string)
    The unique identifier of the tenant the event belongs to.
    Example: 4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a

  - `timestamp` (integer)
    When the event occurred, formatted as a UNIX timestamp (in seconds).
    Example: 1698604061

  - `category` (string)
    The category of the event.
    Enum: "CONTROL"

  - `description` (string)
    The description of the event. Note: this is subject to change and should not be used to match on this object.
    Example: employee@example.com attempted to paste content matching JWT into https://example.com/, but was blocked

  - `object` (string)
    The object that was created.
    Enum: "CLIPBOARD_BLOCKING"

  - `friendlyName` (string)
    The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
    Example: Clipboard blocking

  - `new` (object)
    This object represents a clipboard event (COPY, CUT reported as COPY, or PASTE) that matched a configured clipboard blocking rule.

  - `new.employee` (object)
    This object represents an employee in your organization.

  - `new.employee.id` (string)
    Unique identifier for the employee
    Example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0

  - `new.employee.email` (string)
    Primary email address of the employee
    Example: john.hill@example.com

  - `new.employee.firstName` (string)
    First name of the employee
    Example: John

  - `new.employee.lastName` (string)
    Last name of the employee
    Example: Hill

  - `new.employee.department` (string)
    Department - as provided by connected API integrations
    Example: Security Engineering

  - `new.employee.location` (string)
    Location - as provided by connected API integrations
    Example: New York

  - `new.employee.licensed` (boolean)
    Whether the employee is licensed on the Push platform
    Example: true

  - `new.employee.chatopsEnabled` (boolean)
    Whether the employee has ChatOps enabledDeprecation notice: this value no longer does anything unless you still have access to the legacy Employee chat topics functionality on your account. It will be removed in the next API version.
    Example: true

  - `new.employee.creationTimestamp` (integer)
    When this employee was created, formatted as a UNIX timestamp (in seconds)
    Example: 1698669223

  - `new.browserId` (string)
    The browser instance identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `new.url` (string)
    URL where the clipboard event occurred (frame URL when in an iframe).
    Example: https://chat.openai.com/chat

  - `new.tabUrl` (string)
    URL of the top-level tab.
    Example: https://chat.openai.com/

  - `new.operation` (string)
    The clipboard operation. Cut is reported as COPY.
    Enum: "COPY", "PASTE"

  - `new.action` (string)
    The action taken by the user on the banner. Null on monitor events and on the initial block-enforcement event before the banner is shown.
    Enum: "DISPLAYED", "COPY_ORIGINAL", "COPY_REDACTED"

  - `new.mode` (string)
    Mode of the matching rule.
    Enum: "MONITOR", "WARN", "BLOCK"

  - `new.clipboardBlocking` (object)
    Details of the warn/block banner shown to the employee. All fields are null on monitor events.

  - `new.clipboardBlocking.title` (string)
    The title of the banner shown to the employee.
    Example: Sensitive content detected

  - `new.clipboardBlocking.subtext` (string)
    The subtext of the banner shown to the employee, as rendered HTML.
    Example: A clipboard copy on https://example.com was blocked because it contained content flagged by our security policy. The following was found: JWT Token.

  - `new.clipboardBlocking.copyRedactedButtonText` (string)
    The Copy redacted button text. Null in MONITOR mode and for rules with no content patterns.
    Example: Copy redacted version

  - `new.clipboardBlocking.copyOriginalButtonText` (string)
    The Copy original button text. Only applicable in WARN mode.
    Example: Copy original version

  - `new.clipboardBlocking.acknowledgeButtonText` (string)
    The Acknowledge button text. Only applicable in BLOCK mode for rules with no content patterns.
    Example: Understood

  - `new.incognito` (boolean)
    True if the browser was in private / incognito mode.

  - `new.sourceIpAddress` (string)
    Source IP address of the request that submitted the event.
    Example: 8.158.25.38

  - `new.browser` (string)
    The browser used by the employee
    Enum: "CHROME", "FIREFOX", "EDGE", "SAFARI", "OPERA", "BRAVE", "ARC", "ISLAND", "PRISMA_ACCESS", "UNKNOWN"

  - `new.os` (string)
    The OS used by the employee
    Enum: "MACOS", "WINDOWS", "LINUX", "CHROME_OS", "IOS", "ANDROID", "UNKNOWN"

  - `new.userAgent` (string)
    The user agent string reported by the browser.

  - `new.contentMatch` (object)
    This object represents a match for clipboard content.

  - `new.contentMatch.enum` (string)
    The type of content match, formatted as an ENUM value.
    Example: JWT

  - `new.contentMatch.regex` (string)
    Regex pattern that matched the clipboard content.
    Example: eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}

  - `new.contentMatch.hash` (string)
    SHA-256 hash of the clipboard content.
    Example: 6767d8f5dd1f782b4d5bd0c537bb7f8478b8d4adfbcabfb955238a5e292e959c

  - `new.content` (string)
    Captured clipboard content, ≤ 200 KB. Null when content capture is disabled.