Skip to content
/
Finding

Finding
Webhook

Request

Security
X-Signature
Headers
X-Signaturestringrequired
Example:X-Signature: t=1492774577,v1=5257a869...
Bodyapplication/json

A finding was created, updated or deleted.

versionstring

The version of the event.

Example:"1"
idstring, (uuid)

The unique identifier for the event. This can be used as an idempotency key.

Example:"c478966c-f927-411c-b919-179832d3d50c"
tenantIdstring, (uuid)

The unique identifier of the tenant the event belongs to.

Example:"4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a"
tenantMetadataobject(Tenant Metadata)

Key/value metadata set by the partner that manages this tenant. Only present for tenants managed by a partner. When a partner manages the tenant but has set no metadata, it is present as an empty object rather than omitted or null. A partner may set at most 10 entries, with keys up to 40 characters and values up to 256 characters.

Example:
{
  "customerRef": "ACME-001",
  "region": "emea"
}
timestampinteger

When the event occurred, formatted as a UNIX timestamp (in seconds).

Example:1698604061
typestring

The type of event that occurred.

Enum:"CREATE""UPDATE""DELETE"
categorystring

The category of the event.

Value:"ENTITY"
descriptionstring

The description of the event. Note: this is subject to change and should not be used to match on this object.

Example:"MFA not registered finding observed for user@example.com on Google Workspace"
objectstring

The object that was created, updated or deleted.

Value:"FINDING"
friendlyNamestring

The friendly name of this object. Note: this is subject to change and should not be used to match on this object.

Example:"Finding"
newobject(Finding)

The new state of the object. This is null when the event type is DELETE.

oldobject(Finding)

The previous state of the object. This is null when the event type is CREATE.

Payload
{
  "version": "1",
  "id": "c478966c-f927-411c-b919-179832d3d50c",
  "tenantId": "4f9d2e7a-1b3c-4d5e-8f6a-7c8b9d0e1f2a",
  "tenantMetadata": {
    "customerRef": "ACME-001",
    "region": "emea"
  },
  "timestamp": 1698604061,
  "type": "CREATE",
  "category": "ENTITY",
  "description": "MFA not registered finding observed for user@example.com on Google Workspace",
  "object": "FINDING",
  "friendlyName": "Finding",
  "new": {
    "id": "d6a32ba5-0532-4a66-8137-48cdf409c972",
    "type": "MFA_NOT_REGISTERED",
    "state": "OPEN",
    "employeeId": "379ac7ea-ff2a-42ef-af37-06d2020dc46a",
    "employee": {
      "id": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
      "email": "john.hill@example.com",
      "firstName": "John",
      "lastName": "Hill",
      "department": "Security Engineering",
      "location": "New York",
      "licensed": true,
      "chatopsEnabled": true,
      "creationTimestamp": 1698669223
    },
    "passwordId": "c4a045a1-5331-4714-af83-6a361e98960d",
    "accountId": "string",
    "appType": "PUSH_SECURITY",
    "appId": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
    "creationTimestamp": 1698064423
  },
  "old": {
    "id": "d6a32ba5-0532-4a66-8137-48cdf409c972",
    "type": "MFA_NOT_REGISTERED",
    "state": "OPEN",
    "employeeId": "379ac7ea-ff2a-42ef-af37-06d2020dc46a",
    "employee": {
      "id": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
      "email": "john.hill@example.com",
      "firstName": "John",
      "lastName": "Hill",
      "department": "Security Engineering",
      "location": "New York",
      "licensed": true,
      "chatopsEnabled": true,
      "creationTimestamp": 1698669223
    },
    "passwordId": "c4a045a1-5331-4714-af83-6a361e98960d",
    "accountId": "string",
    "appType": "PUSH_SECURITY",
    "appId": "2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0",
    "creationTimestamp": 1698064423
  }
}

Responses

Return any 2XX status to indicate that the data was received successfully