# Add a new EDR exclusion rule

Adds a new exclusion rule to the EDR system. The rule prevents the EDR engine from raising alerts on trusted files, certificates, paths, or behaviours. Validates pattern format and checks for duplicate entries before saving.

## Endpoint

**POST** `/edr/api/ext/exclusion`

## Request URL

https://[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)/edr/api/ext/exclusion

## Scope

`DesktopCentralCloud.EDR.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** `string` — **Mandatory**: `application/json`

### Request Body

`application/json`

- `JSON Object`
  - **data** `JSON Object` — Optional  
    The exclusion rule definition object containing the type, detection source, and matching value.

## Sample Request

```curl
curl --request POST \
  --url https://appdomains/edr/api/ext/exclusion \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{}'
```

## Sample Request Body

### Add exclusion by signer certificate

```json
{
  "data": {
    "signer_certificate": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2",
    "exclusion_type": 1,
    "exclusion_name": "Trusted Certificate",
    "detection_source": 1
  }
}
```

### Add exclusion by executable path with behaviour IDs

```json
{
  "data": {
    "behaviour_id": [
      "101",
      "102"
    ],
    "exclusion_type": 3,
    "exclusion_name": "MyApp Exclusion",
    "detection_source": 1,
    "executable_path": "C:\\Program Files\\MyApp\\myapp.exe",
    "allowed_path": [
      "C:\\Logs\\"
    ],
    "command_line": [
      "--safe-mode"
    ],
    "command": [
      "Get-Process"
    ]
  }
}
```

### Add exclusion by SHA-256 hash

```json
{
  "data": {
    "exclusion_type": 2,
    "exclusion_name": "Trusted Binary",
    "sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
    "detection_source": 1
  }
}
```

## Response Parameters

### HTTP code 400

Response Body — `application/json`

- `JSON Object`
  - **errorCode** `string`  
    Exclusion validation error code.  
    EDREX0002 or IAM0025 — exclusion value does not match the required regex pattern.  
    EDRCFG0001 — the selected detection_source is not supported for the user's product role.  
    EDRCOMMON001 — Internal server error occurred while do the operation.
  - **errorMessage** `string`  
    Detailed message explaining the specific validation failure.

### HTTP code 409

Response Body — `application/json`

- `JSON Object`
  - **errorCode** `string`  
    EDREX0001 — Duplicate exclusion rule. An exclusion with the same data already exists for this customer.
  - **errorMessage** `string`  
    Message indicating the exclusion rule already exists.

### HTTP code 429

Response Body — `application/json`

- `JSON Object`
  - **errorCode** `string`  
    Rate limit error code.  
    IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
  - **errorMessage** `string`  
    Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- **200** `HTTP code`
- **400** `HTTP code`
- **409** `HTTP code`
- **429** `HTTP code`

## Sample Response: HTTP 200

```text
200 OK
```

## Sample Response: HTTP 400

### Exclusion value fails regex validation

```json
{
  "errorCode": "IAM0025",
  "url": "/edr/api/ext/exclusion",
  "errorMsg": "{param_name} is an invalid parameter format."
}
```

### User role does not permit the selected detection source

```json
{
  "errorMessage": "Unsupported Engine for this Product",
  "errorCode": "EDRCFG0001"
}
```

### Server-side error during exclusion processing

```json
{
  "errorCode": "EDRCOMMON001",
  "errorMsg": "Exception while deploying Exclusion config"
}
```

## Sample Response: HTTP 409

### Exclusion rule already exists

```json
{
  "errorMessage": "Rule already added",
  "errorCode": "EDREX0001"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/exclusion",
  "errorMsg": "The URL /edr/api/ext/exclusion was called too many times. Please retry after a while."
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.