# Malicious browser extension detection excluded extensions removed

A set of extensions have been removed from the list of excluded extensions for the malicious browser extension detection feature.

Endpoint: POST malicious-browser-extension-detection-excluded-extensions-removed
Version: v1
Security: X-Signature

## Header parameters:

  - `X-Signature` (string, required)
    Example: "X-Signature: t=1492774577,v1=5257a869..."

## Request fields (application/json):

  - `version` (string, required)
    The version of the event.
    Example: "1"

  - `id` (string, required)
    The unique identifier for the event. This can be used as an idempotency key.
    Example: "c478966c-f927-411c-b919-179832d3d50c"

  - `timestamp` (integer, required)
    When the event occurred, formatted as a UNIX timestamp (in seconds).
    Example: 1698604061

  - `category` (string, required)
    The category of the event.
    Enum: "AUDIT"

  - `object` (string, required)
    The object that was created.
    Enum: "MALICIOUS_BROWSER_EXTENSION_DETECTION_EXCLUDED_EXTENSIONS_REMOVED"

  - `actor` (object, required)
    This object contains information about the user that performed the action triggering the audit log.

  - `actor.source` (string, required)
    The source of the action that generated the event.
    Enum: "UI"

  - `actor.email` (string, required)
    The email address of the actor.

  - `actor.sourceIpAddress` (string, required)
    The IP address of the actor.

  - `actor.userAgent` (string,null, required)
    The user agent of the actor, if available.

  - `actor.role` (string,null, required)
    The role of the actor.
    Enum: "OWNER", "FULL_ACCESS", "READ_ONLY"

  - `new` (object, required)

  - `new.excludedExtensions` (array, required)
    A list of the removed excluded extensions.

  - `new.excludedExtensions.extensionId` (string, required)
    The identifier of the excluded browser extension.
    Example: "dljjddkmmcminffjbcmeccgfbjlhmhlm"

  - `new.excludedExtensions.notes` (string,null)
    Optional notes about the exclusion.

  - `description` (string)
    The description of the event. Note: this is subject to change and should not be used to match on this object.
    Example: "user@example.com removed excluded extensions"

  - `friendlyName` (string)
    The friendly name of this object. Note: this is subject to change and should not be used to match on this object.
    Example: "Malicious browser extension detection excluded extensions removed"


## Response 2XX fields