Trellix Web Gateway Anti-Malware API

openapi: 3.1.0
info:
  title: Trellix Web Gateway Policy Anti-Malware API
  description: API for creating, updating, and managing security policies, rule sets, and configurations for web filtering and threat prevention on Trellix Web Gateway (formerly McAfee Web Gateway). Provides programmatic access to policy rules, URL filter settings, anti-malware settings, and SSL scanning configurations.
  version: '1.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
    email: support@trellix.com
  termsOfService: https://www.trellix.com/legal/terms-of-use/
servers:
- url: https://{mwg-server}:{port}/Konfigurator/REST/policy
  description: Trellix Web Gateway Policy Endpoint
  variables:
    mwg-server:
      default: mwg.example.com
      description: Hostname or IP address of the Web Gateway appliance
    port:
      default: '4712'
      description: Management port for the REST API
security:
- cookieAuth: []
tags:
- name: Anti-Malware
  description: Anti-malware scanning configuration
paths:
  /antimalware/engines:
    get:
      operationId: listAntiMalwareEngines
      summary: List anti-malware engines
      description: Retrieve the list of configured anti-malware scanning engines and their current status.
      tags:
      - Anti-Malware
      responses:
        '200':
          description: List of anti-malware engines
          content:
            application/json:
              schema:
                type: object
                properties:
                  engines:
                    type: array
                    items:
                      $ref: '#/components/schemas/AntiMalwareEngine'
        '401':
          description: Unauthorized
  /antimalware/settings:
    get:
      operationId: getAntiMalwareSettings
      summary: Get anti-malware settings
      description: Retrieve the current anti-malware scanning configuration including enabled engines, scan behavior, and file type handling.
      tags:
      - Anti-Malware
      responses:
        '200':
          description: Anti-malware settings
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AntiMalwareSettings'
        '401':
          description: Unauthorized
    put:
      operationId: updateAntiMalwareSettings
      summary: Update anti-malware settings
      description: Update the anti-malware scanning configuration. Changes must be committed to take effect.
      tags:
      - Anti-Malware
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AntiMalwareSettings'
      responses:
        '200':
          description: Settings updated
        '400':
          description: Invalid settings
        '401':
          description: Unauthorized
components:
  schemas:
    AntiMalwareEngine:
      type: object
      properties:
        name:
          type: string
          description: Engine name
        version:
          type: string
          description: Engine version
        signatureDate:
          type: string
          format: date-time
          description: Last signature update timestamp
        enabled:
          type: boolean
          description: Whether the engine is enabled
        status:
          type: string
          enum:
          - active
          - updating
          - error
          description: Current engine status
    AntiMalwareSettings:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether anti-malware scanning is enabled
        engines:
          type: array
          items:
            type: string
          description: List of enabled engine names
        scanDirection:
          type: string
          enum:
          - both
          - request_only
          - response_only
          description: Direction of traffic to scan
        maxScanSize:
          type: integer
          description: Maximum file size to scan in bytes
        blockOnError:
          type: boolean
          description: Whether to block if scanning fails
        gatewayAntiMalwareEnabled:
          type: boolean
          description: Whether Gateway Anti-Malware (GAM) engine is enabled
  securitySchemes:
    cookieAuth:
      type: apiKey
      in: cookie
      name: JSESSIONID
      description: Session cookie obtained via the Konfigurator REST /login endpoint.
externalDocs:
  description: Trellix Web Gateway Policy API Documentation
  url: https://docs.trellix.com/bundle/web-gateway-policy-api