# Update an existing EDR exclusion rule

Updates an existing exclusion rule identified by the exclusionId path parameter. Validates pattern correctness and checks for duplicate entries, excluding the record being modified.

## Endpoint

[PUT /edr/api/ext/exclusion/{exclusion_id}](https://www.manageengine.com/products/desktop-central/help/api/onpremise/edrexclusion-modify-exclusion.html)

## Request URL

`https://{server-hostname}:8383/edr/api/ext/exclusion/{exclusion_id}`

## Scope

`EDR.WRITE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** — string — **Mandatory**
  - `application/json`

### Path Parameters

- **exclusion_id** — string — **Mandatory**
  - A unique identifier assigned to each exclusion that is added. Get `exclusion_id` from [Get Exclusion details](https://www.manageengine.com/products/desktop-central/help/api/onpremise/edrview-exclusion-get-exclusions.html).

### Query Parameters

- **pageLimit** — integer — Optional
- **page** — integer — Optional
- **searchColumn** — string — Optional
- **searchValue** — string — Optional

### Request Body

`application/json`

- JSON Object
  - **data** — JSON Object — Optional
    - The exclusion rule definition object containing the type, detection source, and matching value.
  - **exclusion_type** — string — **Mandatory**
    - Type of exclusion.
    - `1` = Signer Certificate
    - `2` = SHA-256 Hash
    - `3` = Executable Path
    - `4` = Glob Pattern
  - **detection_source** — string — **Mandatory**
    - The detection engine to exclude from.
    - `0` - Select All.
    - `1` - Ransomware Detection Engine
    - `2` - Behavior Detection Engine
    - `3` - DeepAV Engine
    - `4` - Third Party AV Alert
    - `5` - Exfiltration Detection Engine Other values apply to the NGAV/Behaviour engine.
  - **signer_certificate** — string — Optional
    - Signer certificate thumbprint (40-char hex). Required when `exclusion_type = 1`.
  - **sha_256** — string — Optional
    - SHA-256 hash of the file (64-char hex). Required when `exclusion_type = 2`.
  - **executable_path** — string — Optional
    - Absolute Windows executable path (e.g., `C:\Program Files\App\app.exe`). Required when `exclusion_type = 3`.
  - **glob** — string — Optional
    - Glob pattern for file path matching (e.g., `C:\Logs*.log`). Required when `exclusion_type = 4`.
  - **exclusion_name** — string — Optional
    - A human-readable label for the exclusion rule.
  - **pe_internal_name** — string — Optional
    - Internal PE (Portable Executable) name of the file.
  - **behaviour_id** — JSON Array — Optional
    - List of behaviour alert IDs to exclude. Fetch available IDs from [Get Behavior Alerts](https://www.manageengine.com/products/desktop-central/help/api/onpremise/edrexclusion-get-behavior-alerts.html).
  - **allowed_path** — JSON Array — Optional
    - List of file paths permitted alongside this exclusion.
  - **command_line** — JSON Array — Optional
    - Command-line argument values associated with the exclusion.
  - **command** — JSON Array — Optional
    - PowerShell command values to be excluded.

## Sample Request

```curl
curl --request PUT \
  --url 'https://appdomain/edr/api/ext/exclusion/{exclusion_id}?pageLimit=SOME_INTEGER_VALUE&page=SOME_INTEGER_VALUE&searchColumn=SOME_STRING_VALUE&searchValue=SOME_STRING_VALUE' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"data":{"exclusion_type":2,"exclusion_name":"Updated Hash Exclusion","sha_256":"abc123def456abc123def456abc123def456abc123def456abc123def456abc1","detection_source":1}}'
```

### Sample Request Body

Update exclusion to use SHA-256 hash

```json
{
  "data": {
    "exclusion_type": 2,
    "exclusion_name": "Updated Hash Exclusion",
    "sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
    "detection_source": 1
  }
}
```

## Response Parameters

### HTTP Code 400

Response Body — `application/json`

- JSON Object
  - **errorCode** — string
    - Exclusion validation error code.
    - `EDREX0002` or `IAM0025` — exclusion value does not match the required regex pattern.
    - `EDRCFG0001` — the selected `detection_source` is not supported for the user's product role.
    - `EDRCOMMON001` — Internal server error occurred while do the operation.
  - **errorMessage** — string
    - Detailed message explaining the specific validation failure.

### HTTP Code 409

Response Body — `application/json`

- JSON Object
  - **errorCode** — string
    - `EDREX0001` — Another exclusion with identical data already exists for this customer.
  - **errorMessage** — string
    - Message indicating the exclusion rule conflicts with an existing entry.

### HTTP Code 429

Response Body — `application/json`

- JSON Object
  - **errorCode** — string
    - Rate limit error code.
    - `IAM0019` — Returned when the API call threshold is exceeded within the defined duration window.
  - **errorMessage** — string
    - Rate limit exceeded message with guidance on when to retry.

## Sample Response: HTTP 200

```text
200 OK
```

### Sample Response: HTTP 400

Exclusion value fails regex validation

```json
{
  "errorCode": "IAM0025",
  "url": "/edr/api/ext/exclusion/{exclusion_id}",
  "errorMsg": "{param_name} is an invalid parameter format."
}
```

User role does not permit the selected detection source

```json
{
  "errorMessage": "Unsupported Engine for this Product",
  "errorCode": "EDRCFG0001"
}
```

Server-side error during exclusion processing

```json
{
  "errorMessage": "Exception while Editing exclusion",
  "errorCode": "EDRCOMMON001"
}
```

### Sample Response: HTTP 409

Another exclusion with the same data already exists

```json
{
  "errorMessage": "Rule already added",
  "errorCode": "EDREX0001"
}
```

### Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/exclusion/{exclusion_id}",
  "errorMsg": "The URL /edr/api/ext/exclusion/{exclusion_id} was called too many times. Please retry after a while."
}
```

## Rate Limiting

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.