[the_imp]

The Objective-C format strings in the URL would imply that the hash is sent as a path parameter.

[usmannk]

That's a string found in the disassembly of syspolicyd (I've found it as well). However, the actual URL you see in the TCP logs has no path whatsoever.