# es_new_descendants_client(_:_:) Create a new ES client scoped to descendant processes only. ``` func es_new_descendants_client(_ client: UnsafeMutablePointer, _ handler: @escaping es_handler_block_t) -> es_new_client_result_t ``` ## Parameters `client` Out param. On success, set to the newly created es_client_t. `handler` The handler block invoked for each event. ## Return Value es_new_client_result_t indicating success or a specific error. ## Discussion The returned client receives notify events for the calling process and auth+notify events for its descendant processes (the entire subtree rooted at the calling process). This includes descendants that already exist at the time the client is created as well as any forked or exec’d afterward, recursively. All other processes are invisible. Process muting works, but only for processes that are already in the descendant subtree. es_mute_process / es_mute_process_events (and their unmute counterparts) succeed for a process the client can already observe and return ES_RETURN_ERROR for any process outside the subtree; the client cannot reach a process it was never allowed to see. Path muting and target-path muting work normally. \note Requires the com.apple.developer.endpoint-security.client entitlement. \note Does NOT require root privilege. \note Does NOT require TCC approval. \note Events will be delivered when a descendant submits the event or instigates it --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)