Package google.cloud.webrisk.v1alpha1

Index

• WebRiskServiceV1Alpha1 (interface)
• Checksum (message)
• ClientInfo (message)
• CompressionType (enum)
• FetchThreatListUpdatesRequest (message)
• FetchThreatListUpdatesRequest.ListUpdateRequest (message)
• FetchThreatListUpdatesRequest.ListUpdateRequest.Constraints (message)
• FetchThreatListUpdatesResponse (message)
• FetchThreatListUpdatesResponse.ListUpdateResponse (message)
• FetchThreatListUpdatesResponse.ListUpdateResponse.ResponseType (enum)
• FindFullHashesRequest (message)
• FindFullHashesResponse (message)
• FindThreatMatchesRequest (message)
• FindThreatMatchesResponse (message)
• ListThreatListsResponse (message)
• PlatformType (enum)
• RawHashes (message)
• RawIndices (message)
• RiceDeltaEncoding (message)
• ThreatEntry (message)
• ThreatEntryMetadata (message)
• ThreatEntryMetadata.MetadataEntry (message)
• ThreatEntrySet (message)
• ThreatEntryType (enum)
• ThreatInfo (message)
• ThreatListDescriptor (message)
• ThreatMatch (message)
• ThreatType (enum)

WebRiskServiceV1Alpha1

Web Risk v1alpha1 API is a mirror of the SafeBrowsing v4 API (google3/google/security/safebrowsing/v4/safebrowsing.proto) aimed at serving enterprise customers.

FetchThreatListUpdates
rpc FetchThreatListUpdates(FetchThreatListUpdatesRequest) returns (FetchThreatListUpdatesResponse) Fetches the most recent threat list updates. A client can request updates for multiple lists at once. Authorization Scopes Requires the following OAuth scope: https://www.googleapis.com/auth/cloud-platform For more information, see the Authentication Overview.

FindFullHashes
rpc FindFullHashes(FindFullHashesRequest) returns (FindFullHashesResponse) Finds the full hashes that match the requested hash prefixes. Authorization Scopes Requires the following OAuth scope: https://www.googleapis.com/auth/cloud-platform For more information, see the Authentication Overview.

FindThreatMatches
rpc FindThreatMatches(FindThreatMatchesRequest) returns (FindThreatMatchesResponse) Finds the threat entries that match the given lists. Authorization Scopes Requires the following OAuth scope: https://www.googleapis.com/auth/cloud-platform For more information, see the Authentication Overview.

ListThreatLists
rpc ListThreatLists(Empty) returns (ListThreatListsResponse) Lists the threat lists available for download. Authorization Scopes Requires the following OAuth scope: https://www.googleapis.com/auth/cloud-platform For more information, see the Authentication Overview.

Checksum

The expected state of a client's local database.

Fields
sha256	bytes The SHA256 hash of the client state; that is, of the sorted list of all hashes present in the database.

ClientInfo

The client metadata associated with API requests.

Fields
client_id	string A client ID that (hopefully) uniquely identifies the client implementation of the API.
client_version	string The version of the client implementation.

CompressionType

The ways in which threat entry sets can be compressed.

Enums
COMPRESSION_TYPE_UNSPECIFIED	Unknown.
RAW	Raw, uncompressed data.
RICE	Rice-Golomb encoded data.

FetchThreatListUpdatesRequest

Describes an API update request. Clients can request updates for multiple lists in a single request.

Fields
client	ClientInfo The client metadata.
list_update_requests[]	ListUpdateRequest The requested threat list updates.

ListUpdateRequest

A single list update request.

Fields
threat_type	ThreatType The type of threat posed by entries present in the list.
platform_type	PlatformType The type of platform at risk by entries present in the list.
threat_entry_type	ThreatEntryType The types of entries present in the list.
state	bytes The current state of the client for the requested list (the encrypted client state that was received from the last successful list update).
constraints	Constraints The constraints associated with this request.

Constraints

The constraints for this update.

Fields
max_update_entries	int32 The maximum size in number of entries. The update will not contain more entries than this value. This should be a power of 2 between 2**10 and 2**20. If zero, no update size limit is set.
max_database_entries	int32 Sets the maximum number of entries that the client is willing to have in the local database. This should be a power of 2 between 2**10 and 2**20. If zero, no database size limit is set.
region	string Requests the list for a specific geographic location. If not set the server may pick that value based on the user's IP address. Expects ISO 3166-1 alpha-2 format.
supported_compressions[]	CompressionType The compression types supported by the client.
language	string Requests the lists for a specific language. Expects ISO 639 alpha-2 format.
device_location	string A client's physical location, expressed as a ISO 31166-1 alpha-2 region code.

FetchThreatListUpdatesResponse

Fields
list_update_responses[]	ListUpdateResponse The list updates requested by the clients.
minimum_wait_duration	Duration The minimum duration the client must wait before issuing any update request. If this field is not set clients may update as soon as they want.

ListUpdateResponse

An update to an individual list.

Fields
threat_type	ThreatType The threat type for which data is returned.
threat_entry_type	ThreatEntryType The format of the threats.
platform_type	PlatformType The platform type for which data is returned.
response_type	ResponseType The type of response. This may indicate that an action is required by the client when the response is received.
additions[]	ThreatEntrySet A set of entries to add to a local threat type's list. Repeated to allow for a combination of compressed and raw data to be sent in a single response.
removals[]	ThreatEntrySet A set of entries to remove from a local threat type's list. In practice, this field is empty or contains exactly one ThreatEntrySet.
new_client_state	bytes The new client state, in encrypted format. Opaque to clients.
checksum	Checksum The expected SHA256 hash of the client state; that is, of the sorted list of all hashes present in the database after applying the provided update. If the client state doesn't match the expected state, the client must disregard this update and retry later.

ResponseType

The type of response sent to the client.

Enums
RESPONSE_TYPE_UNSPECIFIED	Unknown.
PARTIAL_UPDATE	Partial updates are applied to the client's existing local database.
FULL_UPDATE	Full updates replace the client's entire local database. This means that either the client was seriously out-of-date or the client is believed to be corrupt.

FindFullHashesRequest

Request to return full hashes matched by the provided hash prefixes.

Fields
client	ClientInfo The client metadata.
client_states[]	bytes The current client states for each of the client's local threat lists.
threat_info	ThreatInfo The lists and hashes to be checked.
api_client	ClientInfo Client metadata associated with callers of higher-level APIs built on top of the client's implementation.

FindFullHashesResponse

Fields
matches[]	ThreatMatch The full hashes that matched the requested prefixes.
minimum_wait_duration	Duration The minimum duration the client must wait before issuing any find hashes request. If this field is not set, clients can issue a request as soon as they want.
negative_cache_duration	Duration For requested entities that did not match the threat list, how long to cache the response.

FindThreatMatchesRequest

Request to check entries against lists.

Fields
client	ClientInfo The client metadata.
threat_info	ThreatInfo The lists and entries to be checked for matches.

FindThreatMatchesResponse

Fields
matches[]	ThreatMatch The threat list matches.

ListThreatListsResponse

Fields
threat_lists[]	ThreatListDescriptor The lists available for download by the client.

PlatformType

Types of platforms.

Enums
PLATFORM_TYPE_UNSPECIFIED	Unknown platform.
WINDOWS	Threat posed to Windows.
LINUX	Threat posed to Linux.
ANDROID	Threat posed to Android.
OSX	Threat posed to OS X.
IOS	Threat posed to iOS.
ANY_PLATFORM	Threat posed to at least one of the defined platforms.
ALL_PLATFORMS	Threat posed to all defined platforms.
CHROME	Threat posed to Chrome.

RawHashes

The uncompressed threat entries in hash format of a particular prefix length. Hashes can be anywhere from 4 to 32 bytes in size. A large majority are 4 bytes, but some hashes are lengthened if they collide with the hash of a popular URL.

Used for sending ThreatEntrySet to clients that do not support compression, or when sending non-4-byte hashes to clients that do support compression.

Fields
prefix_size	int32 The number of bytes for each prefix encoded below. This field can be anywhere from 4 (shortest prefix) to 32 (full SHA256 hash).
raw_hashes	bytes The hashes, in binary format, concatenated into one long string. Hashes are sorted in lexicographic order. For JSON API users, hashes are base64-encoded.

RawIndices

A set of raw indices to remove from a local list.

Fields
indices[]	int32 The indices to remove from a lexicographically-sorted local list.

RiceDeltaEncoding

The Rice-Golomb encoded data. Used for sending compressed 4-byte hashes or compressed removal indices.

Fields
first_value	int64 The offset of the first entry in the encoded data, or, if only a single integer was encoded, that single integer's value. If the field is empty or missing, assume zero.
rice_parameter	int32 The Golomb-Rice parameter, which is a number between 2 and 28. This field is missing (that is, zero) if num_entries is zero.
num_entries	int32 The number of entries that are delta encoded in the encoded data. If only a single integer was encoded, this will be zero and the single value will be stored in first_value.
encoded_data	bytes The encoded deltas that are encoded using the Golomb-Rice coder.

ThreatEntry

An individual threat; for example, a malicious URL or its hash representation. Only one of these fields should be set.

Fields
hash	bytes A hash prefix, consisting of the most significant 4-32 bytes of a SHA256 hash. This field is in binary format. For JSON requests, hashes are base64-encoded.
url	string A URL.
digest	bytes The digest of an executable in SHA256 format. The API supports both binary and hex digests. For JSON requests, digests are base64-encoded.

ThreatEntryMetadata

The metadata associated with a specific threat entry. The client is expected to know the metadata key/value pairs associated with each threat type.

Fields
entries[]	MetadataEntry The metadata entries.

MetadataEntry

A single metadata entry.

Fields
key	bytes The metadata entry key. For JSON requests, the key is base64-encoded.
value	bytes The metadata entry value. For JSON requests, the value is base64-encoded.

ThreatEntrySet

A set of threats that should be added or removed from a client's local database.

Fields
compression_type	CompressionType The compression type for the entries in this set.
raw_hashes	RawHashes The raw SHA256-formatted entries.
raw_indices	RawIndices The raw removal indices for a local list.
rice_hashes	RiceDeltaEncoding The encoded 4-byte prefixes of SHA256-formatted entries, using a Golomb-Rice encoding. The hashes are converted to uint32, sorted in ascending order, then delta encoded and stored as encoded_data.
rice_indices	RiceDeltaEncoding The encoded local, lexicographically-sorted list indices, using a Golomb-Rice encoding. Used for sending compressed removal indices. The removal indices (uint32) are sorted in ascending order, then delta encoded and stored as encoded_data.

ThreatEntryType

Types of entries that pose threats. Threat lists are collections of entries of a single type.

Enums
THREAT_ENTRY_TYPE_UNSPECIFIED	Unspecified.
URL	A URL.
EXECUTABLE	An executable program.
IP_RANGE	An IP range.
CHROME_EXTENSION	Chrome extension.
FILENAME	Filename.
CERT	CERT

ThreatInfo

The information regarding one or more threats that a client submits when checking for matches in threat lists.

Fields
threat_types[]	ThreatType The threat types to be checked.
platform_types[]	PlatformType The platform types to be checked.
threat_entry_types[]	ThreatEntryType The entry types to be checked.
threat_entries[]	ThreatEntry The threat entries to be checked.

ThreatListDescriptor

Describes an individual threat list. A list is defined by three parameters: the type of threat posed, the type of platform targeted by the threat, and the type of entries in the list.

Fields
threat_type	ThreatType The threat type posed by the list's entries.
platform_type	PlatformType The platform type targeted by the list's entries.
threat_entry_type	ThreatEntryType The entry types contained in the list.

ThreatMatch

A match when checking a threat entry in the threat lists.

Fields
threat_type	ThreatType The threat type matching this threat.
platform_type	PlatformType The platform type matching this threat.
threat_entry_type	ThreatEntryType The threat entry type matching this threat.
threat	ThreatEntry The threat matching this threat.
threat_entry_metadata	ThreatEntryMetadata Optional metadata associated with this threat.
cache_duration	Duration The cache lifetime for the returned match. Clients must not cache this response for more than this duration to avoid false positives.

ThreatType

Types of threats.

Enums
THREAT_TYPE_UNSPECIFIED	Unknown.
MALWARE	Malware threat type.
SOCIAL_ENGINEERING	Social engineering threat type.
UNWANTED_SOFTWARE	Unwanted software threat type.
POTENTIALLY_HARMFUL_APPLICATION	Potentially harmful application threat type.