# File download blocking

Endpoint: POST file-download-blocking
Version: v1
Security: X-Signature

## Header parameters:

  - `X-Signature` (string, required)

## Request fields (application/json):

  - `version` (string)
    The version of the event.
    Example: 1

  - `id` (string)
    The unique identifier for the event. This can be used as an idempotency key.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `tenantId` (string)
    The unique identifier of the tenant the event belongs to.
    Example: 4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a

  - `timestamp` (integer)
    When the event occurred, formatted as a UNIX timestamp (in seconds).
    Example: 1698604061

  - `category` (string)
    The category of the event.
    Enum: "CONTROL"

  - `description` (string)
    The description of the event. Note: this is subject to change and should not be used to match on this object.
    Example: employee@example.com downloaded file.exe from https://phishing-site.com/downloads

  - `object` (string)
    The object that was created.
    Enum: "FILE_DOWNLOAD_BLOCKING"

  - `friendlyName` (string)
    The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
    Example: File download blocking

  - `new` (object)
    This object represents a file download blocking event.

  - `new.employee` (object)
    This object represents an employee in your organization.

  - `new.employee.id` (string)
    Unique identifier for the employee
    Example: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0

  - `new.employee.email` (string)
    Primary email address of the employee
    Example: john.hill@example.com

  - `new.employee.firstName` (string)
    First name of the employee
    Example: John

  - `new.employee.lastName` (string)
    Last name of the employee
    Example: Hill

  - `new.employee.department` (string)
    Department - as provided by connected API integrations
    Example: Security Engineering

  - `new.employee.location` (string)
    Location - as provided by connected API integrations
    Example: New York

  - `new.employee.licensed` (boolean)
    Whether the employee is licensed on the Push platform
    Example: true

  - `new.employee.chatopsEnabled` (boolean)
    Whether the employee has ChatOps enabledDeprecation notice: this value no longer does anything unless you still have access to the legacy Employee chat topics functionality on your account. It will be removed in the next API version.
    Example: true

  - `new.employee.creationTimestamp` (integer)
    When this employee was created, formatted as a UNIX timestamp (in seconds)
    Example: 1698669223

  - `new.url` (string)
    The URL of the file being downloaded.
    Example: https://example.com/downloads/file.exe

  - `new.tabUrl` (string)
    URL of the tab that initiated the download.
    Example: https://example.com/downloads

  - `new.filename` (string)
    Name of the file being downloaded.
    Example: file.exe

  - `new.fileSizeBytes` (integer)
    Total file size in bytes.
    Example: 1024

  - `new.action` (string)
    The action taken by the user on the banner page.  Only applicable in WARN mode.
    Enum: "DISPLAYED", "IGNORED"

  - `new.mode` (string)
    The mode of the file download control rule.
    Enum: "MONITOR", "WARN", "BLOCK"

  - `new.downloadSource` (string)
    Source of the download.
    Enum: "NETWORK", "BLOB_URL", "DATA_URL"

  - `new.error` (string)
    Populated when the configured action could not be enforced (for example, content script injection failed on a restricted origin).

  - `new.fileDownloadBlocking` (object)
    Details of the file download blocking banner.

  - `new.fileDownloadBlocking.title` (string)
    The title of the banner shown to users.
    Example: Download blocked

  - `new.fileDownloadBlocking.subtext` (string)
    The subtext of the banner shown to users.
    Example: This file has been blocked by your organisation's policy.

  - `new.fileDownloadBlocking.buttonText` (string)
    The button text on the banner. Only applicable in WARN mode.
    Example: Download anyway

  - `new.sourceIpAddress` (string)
    The IP address of the user.
    Example: 8.158.25.38

  - `new.browser` (string)
    The browser used by the employee
    Enum: "CHROME", "FIREFOX", "EDGE", "SAFARI", "OPERA", "BRAVE", "ARC", "ISLAND", "PRISMA_ACCESS", "UNKNOWN"

  - `new.os` (string)
    The OS used by the employee
    Enum: "MACOS", "WINDOWS", "LINUX", "CHROME_OS", "IOS", "ANDROID", "UNKNOWN"

  - `new.userAgent` (string)
    The user agent string reported by the browser.
    Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299