Adds a new exclusion rule to the EDR system. The rule prevents the EDR engine from raising alerts on trusted files, certificates, paths, or behaviours. Validates pattern format and checks for duplicate entries before saving.
https://{serverurl}/edr/api/ext/exclusion
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
The exclusion rule definition object containing the type, detection source, and matching value.
Type of exclusion.
1 = Signer Certificate,
2 = SHA-256 Hash,
3 = Executable Path,
4 = Glob Pattern.
The detection engine to exclude from.
0 - Select All.
1 - Ransomware Detection Engine
2 - Behavior Detection Engine
3 - DeepAV Engine
4 - Third Party AV Alert
5 - Exfiltration Detection Engine Other values apply to the NGAV/Behaviour engine.
Signer certificate thumbprint (40-char hex). Required when exclusion_type = 1.
SHA-256 hash of the file (64-char hex). Required when exclusion_type = 2.
Absolute Windows executable path (e.g., C:\Program Files\App\app.exe). Required when exclusion_type = 3.
Glob pattern for file path matching (e.g., C:\Logs*.log). Required when exclusion_type = 4.
A human-readable label for the exclusion rule.
Internal PE (Portable Executable) name of the file.
List of behaviour alert IDs to exclude. Fetch available IDs from Get Behavior Alerts .
A single behaviour alert ID string (e.g., '101'). Fetch from Get Behavior Alerts .
List of file paths permitted alongside this exclusion.
A single allowed file path string (e.g., 'C:\Logs\').
Command-line argument values associated with the exclusion.
A single command-line argument string (e.g., '--safe-mode').
PowerShell command values to be excluded.
A single PowerShell command string (e.g., 'Get-Process').
curl --request POST \
--url https://appdomains/edr/api/ext/exclusion \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{}'Add exclusion by signer certificate
{
"data": {
"signer_certificate": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2",
"exclusion_type": 1,
"exclusion_name": "Trusted Certificate",
"detection_source": 1
}
}
Add exclusion by executable path with behaviour IDs
{
"data": {
"behaviour_id": [
"101",
"102"
],
"exclusion_type": 3,
"exclusion_name": "MyApp Exclusion",
"detection_source": 1,
"executable_path": "C:\\Program Files\\MyApp\\myapp.exe",
"allowed_path": [
"C:\\Logs\\"
],
"command_line": [
"--safe-mode"
],
"command": [
"Get-Process"
]
}
}
Add exclusion by SHA-256 hash
{
"data": {
"exclusion_type": 2,
"exclusion_name": "Trusted Binary",
"sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
"detection_source": 1
}
}
Exclusion validation error code.
EDREX0002 or IAM0025 — exclusion value does not match the required regex pattern.
EDRCFG0001 — the selected detection_source is not supported for the user's product role.
EDRCOMMON001 — Internal server error occurred while do the operation.
Detailed message explaining the specific validation failure.
EDREX0001 — Duplicate exclusion rule. An exclusion with the same data already exists for this customer.
Message indicating the exclusion rule already exists.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
200 OKExclusion value fails regex validation
{
"errorCode": "IAM0025",
"url": "/edr/api/ext/exclusion",
"errorMsg": "{param_name} is an invalid parameter format."
}
User role does not permit the selected detection source
{
"errorMessage": "Unsupported Engine for this Product",
"errorCode": "EDRCFG0001"
}
Server-side error during exclusion processing
{
"errorCode": "EDRCOMMON001",
"errorMsg": "Exception while deploying Exclusion config"
}
Exclusion rule already exists
{
"errorMessage": "Rule already added",
"errorCode": "EDREX0001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/exclusion",
"errorMsg": "The URL /edr/api/ext/exclusion was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.