Graph API Version

Workplace Security (workplace_security)

This topic is only available to Workplace Apps.
Category of updates relating to security events, restricted to Workplace companies.

admin_activity

The admin activity field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

compromised_credentials

The compromised credentials field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

files

The files field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

frontline

The frontline field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

groups

The groups field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

integrations

The integrations field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

invites

The invites field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

passwords

The passwords field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

sessions

The sessions field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook

two_factor

The two factor field of the Workplace Security Webhooks topic

Fields

FieldDescription

field

string

Name of the updated field

value

object

The contents of the update

actor_community_id

numeric string

The community id of the company to which the actor belongs

actor_scim_company_id

numeric string

The company id to which the actor belongs

actor_id

numeric string

The id of the actor for this activity

actor_email

string

The email of the actor for this activity

target_id

numeric string

The id of target for this activity - set to zero if no such user exists

target_email

string

The email of the target of this activity

ip

string

The IP address of the web request

timestamp

datetime

When the activity took place, in UNIX time

event

string

The type of session event that took place

browser_name

string

The name of the browser that issued the web request

browser_os

string

The OS that issued the request, determined from the browser

ip_country

string

The country from which the request originated, determined from the IP address

useragent

string

The useragent string

target_community_id

numeric string

The community id of the company to which the target belongs - set to 0 if there is no target

target_company_id

numeric string

The id of the company to which the target belongs - set to 0 if there is no target

extra_data

object

A map representing extra data captured for each event

censor_reason

string

The reason for why some fields are censored, as a string

compromised_email

string

Email address corresponding to a password which has been compromised

filename

string

Name of the downloaded file

file_post_token

token with structure: Post ID

Graph API token for the post that contained the downloaded file, of the form _

file_group_id

numeric string

ID of the group containing the post with the downloaded file

file_preview_url

string

Relative preview url for the downloaded file

file_mimetype

string

Mimetype of the malicious file which was attempted to be uploaded

new_role

string

The new admin role that a user has been assigned

previous_role

string

The previous admin role of the user

group_id

string

ID of the group that has been created

new_user_name

string

The username that the user has been assigned

previous_user_name

string

The previous username of the user

domain

string

Domain that has been added or removed

integration_data

object

A map representing data associated with custom or app integrations

content_app_type

string

The type of content app integration

custom_integration_name

string

The name of the custom integration

custom_integration_status

string

The installation status of the custom integration

custom_integration_permissions

list<string>

Permissions granted to the custom integration

custom_integration_webhooks

list<WorkplaceSecurityIntegrationWebhookData>

A list of webhooks configured for this integration

topic

string

The topic the webhook is listening to

callback_uri

string

Callback URI of the webhook