<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_event_create_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@SA@es_event_create_t"
  },
  "title" : "es_event_create_t"
}
-->

# es_event_create_t

A type for an event that indicates the creation of a file.

```
struct es_event_create_t
```

## Overview

If the file doesn’t exist — either because it’s awaiting authorization or a client denied authorization —  this type contains the parent directory and file name of the proposed file. If the file does exist, as is the case with notifications of successful file creation, this type contains the full path of the created file. Use the [`destination_type`](/documentation/EndpointSecurity/es_event_create_t/destination_type) member to determine which case this event represents, and then access the [`destination`](/documentation/EndpointSecurity/es_event_create_t/destination) `union` accordingly.

## Topics

### Inspecting Event Properties

[`destination`](/documentation/EndpointSecurity/es_event_create_t/destination)

The file system destination of the created file.

[`destination_type`](/documentation/EndpointSecurity/es_event_create_t/destination_type)

The type of destination for the event, which can be either an existing file or information that describes a new file’s pending location.

[`es_destination_type_t`](/documentation/EndpointSecurity/es_destination_type_t)

A type that indicates how a file event presents its destination to the client.

[`reserved2`](/documentation/EndpointSecurity/es_event_create_t/reserved2)

An unused field reserved for future use.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)