Updates an existing exclusion rule identified by the exclusionId path parameter. Validates pattern correctness and checks for duplicate entries, excluding the record being modified.
put /edr/api/ext/exclusion/{exclusion_id}
https://{serverurl}/edr/api/ext/exclusion/{exclusion_id}
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
A unique identifier assigned to each exclusion that is added, get exclusion_id from Get Exclusion details .
The exclusion rule definition object containing the type, detection source, and matching value.
Type of exclusion.
1 = Signer Certificate,
2 = SHA-256 Hash,
3 = Executable Path,
4 = Glob Pattern.
The detection engine to exclude from.
0 - Select All.
1 - Ransomware Detection Engine
2 - Behavior Detection Engine
3 - DeepAV Engine
4 - Third Party AV Alert
5 - Exfiltration Detection Engine Other values apply to the NGAV/Behaviour engine.
Signer certificate thumbprint (40-char hex). Required when exclusion_type = 1.
SHA-256 hash of the file (64-char hex). Required when exclusion_type = 2.
Absolute Windows executable path (e.g., C:\Program Files\App\app.exe). Required when exclusion_type = 3.
Glob pattern for file path matching (e.g., C:\Logs*.log). Required when exclusion_type = 4.
A human-readable label for the exclusion rule.
Internal PE (Portable Executable) name of the file.
List of behaviour alert IDs to exclude. Fetch available IDs from Get Behavior Alerts .
A single behaviour alert ID string (e.g., '101'). Fetch from Get Behavior Alerts .
List of file paths permitted alongside this exclusion.
A single allowed file path string (e.g., 'C:\Logs\').
Command-line argument values associated with the exclusion.
A single command-line argument string (e.g., '--safe-mode').
PowerShell command values to be excluded.
A single PowerShell command string (e.g., 'Get-Process').
curl --request PUT \
--url https://appdomains/edr/api/ext/exclusion/{exclusion_id} \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{}'Update exclusion to use SHA-256 hash
{
"data": {
"exclusion_type": 2,
"exclusion_name": "Updated Hash Exclusion",
"sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
"detection_source": 1
}
}
Exclusion validation error code.
EDREX0002 or IAM0025 — exclusion value does not match the required regex pattern.
EDRCFG0001 — the selected detection_source is not supported for the user's product role.
EDRCOMMON001 — Internal server error occurred while do the operation.
Detailed message explaining the specific validation failure.
EDREX0001 — Another exclusion with identical data already exists for this customer.
Message indicating the exclusion rule conflicts with an existing entry.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
200 OKExclusion value fails regex validation
{
"errorCode": "IAM0025",
"url": "/edr/api/ext/exclusion/{exclusion_id}",
"errorMsg": "{param_name} is an invalid parameter format."
}
User role does not permit the selected detection source
{
"errorMessage": "Unsupported Engine for this Product",
"errorCode": "EDRCFG0001"
}
Server-side error during exclusion processing
{
"errorMessage": "Exception while Editing exclusion",
"errorCode": "EDRCOMMON001"
}
Another exclusion with the same data already exists
{
"errorMessage": "Rule already added",
"errorCode": "EDREX0001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/exclusion/{exclusion_id}",
"errorMsg": "The URL /edr/api/ext/exclusion/{exclusion_id} was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.