Returns a paginated list of all configured EDR exclusion rules for the authenticated customer. Each record includes the exclusion type, detection source, the excluded value, and metadata such as creation time and the user who added the rule. Supports filtering by engine type, exclusion type, and exclusion name.
https://{serverurl}/edr/api/view/exclusion
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Filter exclusions by detection engine type.
0 - All,
1 - NGAV,
2 - Behaviour,
3 - Ransomware,
5 - Exfiltrate.
Filter exclusions by type.
1 - Signer Certificate,
2 - SHA-256 Hash,
3 - Executable Path,
4 - Glob Pattern,
5 - PE Internal Name.
Filter exclusions by name (partial match supported - e.g., 'example.exe').
Page number for pagination. Defaults to 1.
Number of records per page. Default is 25, maximum is 1000.
curl --request GET \
--url https://appdomains/edr/api/view/exclusion \
--header 'Accept: application/json' \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52'Response status. 'success' if the request completed successfully, 'failure' if an error occurred.
Total number of records matching the applied filters.
Total number of pages available based on the current page limit.
Pagination metadata containing the current page number and page limit.
Number of records returned per page.
Current page number (1-based).
Navigation links to the next and previous pages of results.
URL to the next page of results, in the form '{api_url}?page=
URL to the previous page of results, in the form '{api_url}?page=
Actual exclusion item response.
Unique identifier of the exclusion rule.
Duplicate reference field for the exclusion rule identifier.
Human-readable display version of the exclusion_types field (e.g., 'Signer Certificate').
Human-readable display version of the exclusion_name field.
Human-readable display version of the value field.
Human-readable display version of the detection_source field (e.g., 'Ransomware Engine').
Human-readable display version of the alert_id field (e.g., 'User-Applied').
Internal EDR config record ID associated with this exclusion.
Group ID this exclusion belongs to.
Duplicate reference field for the exclusion group ID.
Internal PE (Portable Executable) name of the excluded process.
Human-readable display version of the first_name field.
User ID of the person who created the exclusion rule.
User ID of the person who last modified the exclusion rule.
Unix timestamp (ms) when the exclusion rule was created.
Human-readable display version of the last_updated_time field (e.g., 'Jan 15, 2025 01:30 PM').
Linked suspicious event ID if this exclusion originated from an alert event. null if not linked to an event.
Customer or tenant identifier this exclusion belongs to.
EDRCOMMON001 — Internal server error occurred while retrieving the EDR exclusion list.
General internal error message.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
Rate limit exceeded message with guidance on when to retry.
Paginated list of configured EDR exclusion rules
{
"metadata": {
"limit": 25,
"page": 3
},
"totalRecords": "51",
"messageResponse": [
{
"value_transform": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"added_time": "1700012600000",
"edrexclusiongrouptoexclusion_exclusion_group_id": "9000000000000003",
"exclusion_group_id": "9000000000000003",
"detection_source_transform": "Ransomware Engine",
"alert_id_transform": "User-Applied",
"exclusion_name_transform": "edr ex",
"edrsuspiciousevent_sup_event_id": null,
"last_modified_by": "1000000000000002",
"last_updated_time_transform": "Jan 15, 2025 01:30 PM",
"exclusion_id": "9000000000000002",
"exclusion_exclusion_id": "9000000000000002",
"first_name_transform": "John",
"exclusion_types_transform": "Signer Certificate",
"user_id": "1000000000000002",
"process_execution_internal_name": "C:/example/process",
"edr_config_id": "9000000000000001",
"customer_id": "1000000000000001"
}
],
"totalPages": 3,
"Links": {
"next": "null",
"prev": "/edr/api/view/exclusion?page=2&pageLimit=25"
},
"status": "success"
}
Unexpected server-side error
{
"errorMessage": "Exception while retrieving EDR exclusion list",
"errorCode": "EDRCOMMON001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/view/exclusion",
"errorMsg": "The URL /edr/api/view/exclusion was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.