''

• Comma separated list of event ids.

• Comma separated list of event ids starting with an exclamation mark.

• Leave empty to handle all events.

Define a comma separated list of event ids to have the event handler triggered only for those events.

When you want to have it triggered for all the events, excepting a few events you should prefix each event id with the exclamation mark (!).

Leave it empty to handle all events.

''

• Comma separated list of event groups.

• Comma separated list of event groups starting with an exclamation mark.

• Empty.

Defines the list of event groups for which this handler is active.

When you want to handle all the events, except for the ones from a set of groups, prefix the group names with the exclamation mark (!).

An event can be a member of one or multiple groups. The event is handled if any of its groups is found in the list of configured allowed groups. The event is not handled if any of its groups is found in the list of configured ignored groups (starting with !).

Leave it empty to handle events from all groups.

''

• Comma separated list of usernames.

• Comma separated list of usernames starting with an exclamation mark.

• Leave empty to handle all events.

Comma separated list of usernames whose events are handled by this event handler. A username can include OS accounts, application accounts, and any accounts accepted by any authentication method including external HTTP accounts.

When you want to have it triggered for all the events, excepting a few events you should prefix each username with the exclamation mark (!).

Leave it empty to handle events from any users or events which are not associated with any user.

''

• Comma separated list of UUIDs.

• Comma separated list of UUIDs starting with an exclamation mark.

• Leave empty to handle all events.

Comma separated list of component UUIDs for which events are handled by this event handler.

When you want to have it triggered for all the events, excepting a few events you should prefix each UUID with the exclamation mark (!).

Leave it empty to handle events emitted by any component.

Empty

• Comma separated list of IP addresses.

• List of IP addresses starting with an exclamation mark.

• Empty.

Comma separated list of source IP addresses of the remote peers, which are handled by this event handler.

When you want to have it triggered for all the addresses, excepting a few addresses you should prefix each address with the exclamation mark (!).

Leave it empty to handle events emitted by any source address.

''

• Comma-separated list of data member names and filter expressions.

• Multiple expressions, one per line (Since 4.29.0)

• Leave empty to handle all events.

Comma separated definition with the name of attribute data member and the targeted matching expression.

Data member names are configured with insensitive cases.

For more details about the available expressions see the matching expression documentation.

The following example will extract the value to be matched/filtered from the path data member of the event. The extracted value is then matched against the */folderA/* globbing expression:

[event-handlers/b904ed23-a234-4ccf-8abd-edcae4d3324f]
data_filter = path, */folderA/*

See the usage instructions for more operational details.

You can filter based on multiple data members using multiple rules. Each rule is defined on a separate line.

In the following example, events are triggered only if they are uploaded into the directory named reports-A with a size of 0 bytes (empty file):

[event-handlers/b904ed23-a234-4ccf-8abd-edcae4d3324f]
data_filter =
    path, */reports-A/*
    size, 0

Leave this configuration empty to not filter based on the event's attached data, and handle events regardless of their data attributes.

10

3.0.0

Number of consecutive errors after which the event handler will automatically stop with a failed state.

Setting this to 0 will disable the feature. The event handler will no longer stop regardless of the number of errors encountered.

''

• URL

• Comma separated list of URLs (Since 3.51.0)

Full URL for a resource used to receive the event details. For example: http://www.acme.io/http-post-hook-url

You can define a fall-back/redundant URL using a comma separates list of URLs. The first URL from the list will be used. When failing to get a response for the first URL, the remaining URLs are tried. Since 3.51.0.

120

• Number of seconds.

Duration, in seconds, to wait for a response from the HTTP server.

If a response is not received during this period, the event handling fails.

2

3.48.0

This is the number of times a failed request is retried.

When set to 0, requests are never retried.

The HTTP POST request is retried on connection errors or when the server returns a 5XX HTTP code.

10

3.48.0

Number of seconds to add to each wait period before retrying.

This is also the value of the first retry wait period.

When set to 0, there will be no waiting time, a retry is performed right away.

''

3.30.0

Username used to authenticate to the remote HTTP server.

Leave this value empty in order to leave out HTTP Basic authentication.

POST

• GET

• POST

• PUT

The HTTP method to use when making the request to the remote server.

You can configure it to values like POST or PUT, to make a request containing the event data in the body payload. The value is case-insensitive.

When configured to GET, it will make an HTTP GET request with an empty HTTP body.

json

• custom

• json

• legacy-webadmin

• soap

• xml

Format used to send the event over HTTP.

Use custom to send the event as a custom Jinja2 template formated value.

Use json to send the event as JSON formated.

Use soap to send the event as human readable XML SOAP envelope.

Use xml to send the event as machine readable application/xml.

Use legacy-webadmin to send the events to the SFTPPlus WebAdmin server.

set-on-first-connection

• PEM content of a CA chain (Since 3.40.0)

• PEM content of a pinned public key (Since 5.1.0)

• Absolute path to a local file

• set-on-first-connection (Since 5.0.0)

• pin-public-key (Since 5.1.0)

• ${MOZILLA_CA_ROOTS} (Since 5.0.0)

• ${LETS_ENCRYPT_X3_CA}

• ${MICROSOFT_IT_CA}

• ${GO_DADDY_G2_G1}

• disable-identity-security (Since 5.0.0)

This is used to validate the identity of the remote server.

Remote server identity can only be validated when the remote address or URL is configured using a fully-qualified domain name. IP-based validation would always fail as this is not a method accepted by Certificate Authorities (CAs).

Configured certificates need to be in PEM format.

Multiple Certificate Authorities can be configured, one after the other. They can be multiple root CAs or intermediate CAs.

When set-on-first-connection is used, the Certificate Authority of the remote server is configured automatically. The set-on-first-connection configuration value is automatically replaced by the actual CA chain of the remove server on the very first connection. For all subsequent connections, the server identity is validated against the automatically configured CA chain.

When pin-public-key is set, SFTPPlus accepts server certificates that have the same public key as the one discovered during the first connection to this server. This is used to implement certificate and public key pinning. SFTPPlus only pins the public key. This can be used for self-signed server certificates.

You can configure the client to validate the server's identity based on a fixed list of public keys. In this way, you can implement public key pinning. When public key validation is used, the public key infrastructure (PKI) certificate policies are not enforced. For example, the server certificate is accepted even if it's expired or issued for a different hostname.

This can be defined as an absolute path on the local filesystem to a file containing the certificates of the Certificate Authorities used to validate the remote peer.

A series of bundle CAs are distributed with SFTPPlus. They can be configured together and mixed with other CA certificates. The bundle CAs are available under the following names:

• ${MOZILLA_CA_ROOTS} - All the root certification authorities accepted by the Mozilla's CA Certificate Program

• ${LETS_ENCRYPT_X3_CA} - For Let's Encrypt X3 certificate authority.

• ${MICROSOFT_IT_CA} - For all Microsoft IT CA certificates, used by SharePoint Online and other services provided by Microsoft.

• ${GO_DADDY_G2_G1} - For all GoDaddy Certificate Bundles, G2 With Cross to G1.

Only servers using certificates signed by one of the configured Certificate Authorities are allowed to communicate with this client.

Leave it empty to disable checking the identity of the remote server.

Empty

• Fully qualified domain name (FQDN)

• Comma separated list of fully qualified domain names

• Empty

Empty

• Absolute path on the local filesystem.

• Certificate in PEM text format (Since 3.40.0).

• Certificate in PKCS12 / PXF binary format (Since 4.0.0).

• Empty

This can be defined as an absolute path on the local filesystem to the file containing the SSL certificate or chain of certificates used by the component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) or PKCS12 / PFX formats.

File extension should be .p12 or .pfx for the file to be recognized as a PCKS-12 certificate. The password for the PCKS12 / PFX certificate should be set in the ssl_key_password configuration option.

You can also define the content of the certificate as text in PEM format. In this case the configuration will look as in the following example. It's important to start each line with at least one space character and keep the number of leading spaces constant:

ssl_certificate = -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

When the value contains both the certificate and the key, the configuration will look as in the following example:

ssl_certificate = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

This certificate is sent to the remote peer during the SSL/TLS handshake process.

The certificate file can contain both the certificate and the private key, in which case you don't need to set the path to the private key. Only supported for PEM encoding.

The certificate file can contain the full chain of certificates. The targeted certificate should be first in the file, followed by the chained certificates. It will advertise the certificate chain in the same order as listed in the file. Only supported for PEM encoding. (Since 3.22.0)

For server-side components using TLS/SSL secure communication, this configuration option is required. If no value is defined here, the global ssl_certificate value is used.

For the client-side component using TLS/SSL, you can disable sending the certificate as part of the handshake, by leaving this configuration option empty.

Empty

• Absolute path on the local filesystem.

• Key as PEM text format (Since 3.40.0).

• Empty

This can be defined as an absolute path on the local filesystem to the X.509 private key file used by this component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_key = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----

If ssl_certificate is not defined, any value defined for this ssl_key configuration is ignored and the global ssl_key value is used.

If the value defined in ssl_certificate option already contains the private key, this option can be omitted by leaving it empty.

Empty

• Password as plain text.

• Empty

This is used to define the password of the private key, when the private X.509 key is stored as an encrypted file.

Leave it empty to not use a password for the private key file.

Empty

• Comma separated list of CRL paths or HTTP URLs.

• crl-distribution-points

• ${MICROSOFT_IT_CRL}

• Empty

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files with absolute paths, in either of the following formats:

• file:///unix/absolute/test-ca.crl

• file://c:\\windows\\absolute\\test-ca.crl

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections. The URL will look as follows:

• http://example.com/some.crl

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the local certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the local certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Leave it empty to disable certificate revocation checks.

The certificate revocation list can only be used when the component is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer's certificate and not for the CA certificate or for an intermediate CA.

The CRL file should be stored in PEM or DER format.

0

• Number of seconds

• 0

This defined the number of seconds after which a configured CRL is reloaded by this component.

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0, the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

For example, a value of 86400 means that the CRL will be re-read after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

secure

• List of SSL/TLS ciphers in OpenSSL format.

• secure

This defined the list of ciphers accepted by this component while communicating over the network.

The special keyword secure contains all the algorithms that we currently consider secure.

Connections are closed if the remote peer has no common cipher in its list of configured ciphers.

When left empty, it will default to the secure configuration.

More information about the accepted values can be found at the cryptography guide

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found on the OpenSSL site.

secure

• secure

• all

• tlsv1.0

• tlsv1.1

• tlsv1.2

• tlsv1.3

This defines the comma-separated list of SSL and TLS methods that are accepted by this component during the secure communication handshake.

Set this to secure to allow only the TLS methods that are currently considered secure. For now, this is TLS 1.2 and TLS 1.3 but this might be changed in the future. Any other configured value is ignored.

Set this to all to allow any supported SSL or TLS method. Any other configured value is ignored.

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.

• tlsv1.1, which is TLS 1.1.

• tlsv1.2, which is TLS 1.2.

• tlsv1.3, which is TLS 1.3.

[services/681f5f5d-0502-4ebb-90d5-5d5c549fac6b]
ssl_cipher_list = RC4-SHA

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added: tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

Support for tlsv1.3 was added in version 3.47.0.

Prior to version 4.17.0, this was configured as a space separated value.

Empty

• Empty

• Matching expression (globbing or regular expression)

If the result result of a web-hook is not returned by the server with the HTTP status header, but by the content of the response, you can use this configuration to define an expected expression for a valid response.

You can read more about how to use this configuration :doc: in the HTTP API Developer</developer/http-api-event-handler> documentation page.

Leave this configuration empty to accept any response.

Empty

• JSON string with variables.

• Text with newline as the only non-printable characters.

• EMPTY

When left empty the HTTP request is sent using the standard SFTPPlus format associated with each content type.

When this is defined, it will be configured as a template used to send the body of the HTTP request.

When defined for json content, it defines the extra JSON values to be included in the HTTP POST payload.

The JSON can be nested and contain multiple objects/dictionaries. The root JSON object can't be an array.

JSON key and values can contain variables which will be replaced based on the event's data.

For example to send the event as an Slack Incoming WebHook message:

[event-handlers/b904ed23-v254-4ccf-8abd-edcae4d3324f]
url = https://hooks.slack.com/services/n2unjSpQQ4L6JIOrHoO9CKXl
http_content_type = json
extra_data = {
    "text": "{id} {message}"
    "username": "{account.name}"
    }

To send the event as custom text message:

[event-handlers/b904ed23-v254-4ccf-8abd-edcae4d3324f]
url = https://hooks.slack.com/services/n2unjSpQQ4L6JIOrHoO9CKXl
http_content_type = custom
headers = Content-Type: text/plain
extra_data = New event with ID {id} from {account.name}. {message}

For more details and examples see the HTTP API documentation.

Below you can find all the available variables.

The following variables (case-insensitive) are provided as context data containing information about the event being triggered:

• id

• uuid

• message

• account.name

• account.email

• account.peer.address

• account.peer.port

• account.peer.protocol

• account.peer.family

• account.uuid

• component.name

• component.type

• component.uuid

• timestamp.cwa_14051

• timestamp.iso_8601

• timestamp.iso_8601_fractional

• timestamp.iso_8601_local

• timestamp.iso_8601_basic

• timestamp.iso_8601_compact

• timestamp.timestamp

• server.name

• server.uuid

• data.DATA_MEMBER_NAME

• data_json

Not available for http_content_type = legacy-webadmin.

You can define a fall-back/redundant URL using a comma separates list of URLs. The first URL from the list will be used. When failing to get a response for the first URL, the remaining URLs are tried.