package google.cloud.webrisk.v1beta1

Get desktop application:
View/edit binary Protocol Buffers messages

Web Risk v1beta1 API defines an interface to detect malicious URLs on your website and in client applications.

• rpc ComputeThreatListDiff (ComputeThreatListDiffRequest, ComputeThreatListDiffResponse)

  webrisk.proto:40

  Gets the most recent threat list diffs.

  message ComputeThreatListDiffRequest

  webrisk.proto:69

  Describes an API diff request.

  • ThreatType threat_type = 1

    The ThreatList to update.

  • bytes version_token = 2

    The current version token of the client for the requested list (the client version that was received from the last successful diff).

  • optional ComputeThreatListDiffRequest.Constraints constraints = 3

    Required. The constraints associated with this request.

  message ComputeThreatListDiffResponse

  webrisk.proto:97

  • ComputeThreatListDiffResponse.ResponseType response_type = 4

    The type of response. This may indicate that an action must be taken by the client when the response is received.

  • optional ThreatEntryAdditions additions = 5

    A set of entries to add to a local threat type's list.

  • optional ThreatEntryRemovals removals = 6

    A set of entries to remove from a local threat type's list. This field may be empty.

  • bytes new_version_token = 7

    The new opaque client version token.

  • optional ComputeThreatListDiffResponse.Checksum checksum = 8

    The expected SHA256 hash of the client state; that is, of the sorted list of all hashes present in the database after applying the provided diff. If the client state doesn't match the expected state, the client must disregard this diff and retry later.

  • optional protobuf.Timestamp recommended_next_diff = 2

    The soonest the client should wait before issuing any diff request. Querying sooner is unlikely to produce a meaningful diff. Waiting longer is acceptable considering the use case. If this field is not set clients may update as soon as they want.

• rpc SearchUris (SearchUrisRequest, SearchUrisResponse)

  webrisk.proto:48

  This method is used to check whether a URI is on a given threatList.

  message SearchUrisRequest

  webrisk.proto:147

  Request to check URI entries against threatLists.

  • string uri = 1

    Required. The URI to be checked for matches.

  • repeated ThreatType threat_types = 2

    Required. The ThreatLists to search in.

  message SearchUrisResponse

  webrisk.proto:155

  • optional SearchUrisResponse.ThreatUri threat = 1

    The threat list matches. This may be empty if the URI is on no list.

• rpc SearchHashes (SearchHashesRequest, SearchHashesResponse)

  webrisk.proto:60

  Gets the full hashes that match the requested hash prefix. This is used after a hash prefix is looked up in a threatList and there is a match. The client side threatList only holds partial hashes so the client must query this method to determine if there is a full hash match of a threat.

  message SearchHashesRequest

  webrisk.proto:171

  Request to return full hashes matched by the provided hash prefixes.

  • bytes hash_prefix = 1

    A hash prefix, consisting of the most significant 4-32 bytes of a SHA256 hash. For JSON requests, this field is base64-encoded.

  • repeated ThreatType threat_types = 2

    Required. The ThreatLists to search in.

  message SearchHashesResponse

  webrisk.proto:180

  • repeated SearchHashesResponse.ThreatHash threats = 1

    The full hashes that matched the requested prefixes. The hash will be populated in the key.

  • optional protobuf.Timestamp negative_expire_time = 2

    For requested entities that did not match the threat list, how long to cache the response until.

The ways in which threat entry sets can be compressed.

Used in: ComputeThreatListDiffRequest.Constraints

• COMPRESSION_TYPE_UNSPECIFIED = 0

  Unknown.

• RAW = 1

  Raw, uncompressed data.

• RICE = 2

  Rice-Golomb encoded data.

The constraints for this diff.

Used in: ComputeThreatListDiffRequest

• int32 max_diff_entries = 1

  The maximum size in number of entries. The diff will not contain more entries than this value. This should be a power of 2 between 2**10 and 2**20. If zero, no diff size limit is set.

• int32 max_database_entries = 2

  Sets the maximum number of entries that the client is willing to have in the local database. This should be a power of 2 between 2**10 and 2**20. If zero, no database size limit is set.

• repeated CompressionType supported_compressions = 3

  The compression types supported by the client.

The expected state of a client's local database.

Used in: ComputeThreatListDiffResponse

• bytes sha256 = 1

  The SHA256 hash of the client state; that is, of the sorted list of all hashes present in the database.

The type of response sent to the client.

Used in: ComputeThreatListDiffResponse

• RESPONSE_TYPE_UNSPECIFIED = 0

  Unknown.

• DIFF = 1

  Partial updates are applied to the client's existing local database.

• RESET = 2

  Full updates resets the client's entire local database. This means that either the client had no state, was seriously out-of-date, or the client is believed to be corrupt.

The uncompressed threat entries in hash format. Hashes can be anywhere from 4 to 32 bytes in size. A large majority are 4 bytes, but some hashes are lengthened if they collide with the hash of a popular URI. Used for sending ThreatEntryAdditons to clients that do not support compression, or when sending non-4-byte hashes to clients that do support compression.

Used in: ThreatEntryAdditions

• int32 prefix_size = 1

  The number of bytes for each prefix encoded below. This field can be anywhere from 4 (shortest prefix) to 32 (full SHA256 hash).

• bytes raw_hashes = 2

  The hashes, in binary format, concatenated into one long string. Hashes are sorted in lexicographic order. For JSON API users, hashes are base64-encoded.

A set of raw indices to remove from a local list.

Used in: ThreatEntryRemovals

• repeated int32 indices = 1

  The indices to remove from a lexicographically-sorted local list.

The Rice-Golomb encoded data. Used for sending compressed 4-byte hashes or compressed removal indices.

Used in: ThreatEntryAdditions, ThreatEntryRemovals

• int64 first_value = 1

  The offset of the first entry in the encoded data, or, if only a single integer was encoded, that single integer's value. If the field is empty or missing, assume zero.

• int32 rice_parameter = 2

  The Golomb-Rice parameter, which is a number between 2 and 28. This field is missing (that is, zero) if `num_entries` is zero.

• int32 entry_count = 3

  The number of entries that are delta encoded in the encoded data. If only a single integer was encoded, this will be zero and the single value will be stored in `first_value`.

• bytes encoded_data = 4

  The encoded deltas that are encoded using the Golomb-Rice coder.

Contains threat information on a matching hash.

Used in: SearchHashesResponse

• repeated ThreatType threat_types = 1

  The ThreatList this threat belongs to. This must contain at least one entry.

• bytes hash = 2

  A 32 byte SHA256 hash. This field is in binary format. For JSON requests, hashes are base64-encoded.

• optional protobuf.Timestamp expire_time = 3

  The cache lifetime for the returned match. Clients must not cache this response past this timestamp to avoid false positives.

Contains threat information on a matching uri.

Used in: SearchUrisResponse

• repeated ThreatType threat_types = 1

  The ThreatList this threat belongs to.

• optional protobuf.Timestamp expire_time = 2

  The cache lifetime for the returned match. Clients must not cache this response past this timestamp to avoid false positives.

Contains the set of entries to add to a local database. May contain a combination of compressed and raw data in a single response.

Used in: ComputeThreatListDiffResponse

• repeated RawHashes raw_hashes = 1

  The raw SHA256-formatted entries. Repeated to allow returning sets of hashes with different prefix sizes.

• optional RiceDeltaEncoding rice_hashes = 2

  The encoded 4-byte prefixes of SHA256-formatted entries, using a Golomb-Rice encoding. The hashes are converted to uint32, sorted in ascending order, then delta encoded and stored as encoded_data.

Contains the set of entries to remove from a local database.

Used in: ComputeThreatListDiffResponse

• optional RawIndices raw_indices = 1

  The raw removal indices for a local list.

• optional RiceDeltaEncoding rice_indices = 2

  The encoded local, lexicographically-sorted list indices, using a Golomb-Rice encoding. Used for sending compressed removal indices. The removal indices (uint32) are sorted in ascending order, then delta encoded and stored as encoded_data.

The type of threat. This maps dirrectly to the threat list a threat may belong to.

Used in: ComputeThreatListDiffRequest, SearchHashesRequest, SearchHashesResponse.ThreatHash, SearchUrisRequest, SearchUrisResponse.ThreatUri

• THREAT_TYPE_UNSPECIFIED = 0

  Unknown.

• MALWARE = 1

  Malware targeting any platform.

• SOCIAL_ENGINEERING = 2

  Social engineering targeting any platform.

• UNWANTED_SOFTWARE = 3

  Unwanted software targeting any platform.