<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_handler_block_t",
  "metadataVersion" : "0.1.0",
  "role" : "Type Alias",
  "symbol" : {
    "kind" : "Type Alias",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@T@es_handler_block_t"
  },
  "title" : "es_handler_block_t"
}
-->

# es_handler_block_t

A block that handles a message received from Endpoint Security.

```
typealias es_handler_block_t = (OpaquePointer, UnsafePointer<es_message_t>) -> Void
```

## Discussion

The block receives two parameters:

- The client that receives the event, as an [`es_client_t`](/documentation/EndpointSecurity/es_client_t) pointer. You pass this client to any `es_respond`-prefixed functions that you call in the handler.
- The message to handle, as an [`es_message_t`](/documentation/EndpointSecurity/es_message_t) pointer.

You implement the handler by inspecting the message and deciding how to respond to it. For example, your handler might receive a message with [`event_type`](/documentation/EndpointSecurity/es_message_t/event_type) [`ES_EVENT_TYPE_AUTH_RENAME`](/documentation/EndpointSecurity/ES_EVENT_TYPE_AUTH_RENAME), indicating that the system wants authorization before renaming a file. Your handler would call [`es_respond_auth_result(_:_:_:_:)`](/documentation/EndpointSecurity/es_respond_auth_result(_:_:_:_:)) to permit or deny the renaming.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)