# Retrieve a paginated list of all configured EDR exclusion rules

Returns a paginated list of all configured EDR exclusion rules for the authenticated customer. Each record includes the exclusion type, detection source, the excluded value, and metadata such as creation time and the user who added the rule. Supports filtering by engine type, exclusion type, and exclusion name.

## Endpoint

`GET /edr/api/view/exclusion`

## Request URL

`https://{server-hostname}:8383/edr/api/view/exclusion`

## Scope

`EDR.READ`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Accept** (`string`, Mandatory): `application/json`

### Query Parameters

- **engineType** (`string`, Optional): Filter exclusions by detection engine type.
  - `0` - All
  - `1` - NGAV
  - `2` - Behaviour
  - `3` - Ransomware
  - `5` - Exfiltrate.
- **exclusionType** (`string`, Optional): Filter exclusions by type.
  - `1` - Signer Certificate
  - `2` - SHA-256 Hash
  - `3` - Executable Path
  - `4` - Glob Pattern
  - `5` - PE Internal Name.
- **exclusionName** (`string`, Optional): Filter exclusions by name (partial match supported - e.g., 'example.exe').
- **page** (`string`, Optional): Page number for pagination. Defaults to 1.
- **pageLimit** (`string`, Optional): Number of records per page. Default is 25, maximum is 1000.

## Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/edr/api/view/exclusion?engineType=SOME_STRING_VALUE&exclusionType=SOME_STRING_VALUE&exclusionName=SOME_STRING_VALUE&page=SOME_STRING_VALUE&pageLimit=SOME_STRING_VALUE' \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52'
```

## Response Parameters

### HTTP code 200

#### Response Body - application/json

`JSON Object`

- **status** (`string`): Response status. 'success' if the request completed successfully, 'failure' if an error occurred.
- **totalRecords** (`string`): Total number of records matching the applied filters.
- **totalPages** (`string`): Total number of pages available based on the current page limit.
- **metadata** (`JSON Object`): Pagination metadata containing the current page number and page limit.
- **Links** (`JSON Object`): Navigation links to the next and previous pages of results.
- **messageResponse** (`JSON Object`): Actual exclusion item response.

### HTTP code 400

#### Response Body - application/json

`JSON Object`

- **errorCode** (`string`): `EDRCOMMON001` — Internal server error occurred while retrieving the EDR exclusion list.
- **errorMessage** (`string`): General internal error message.

### HTTP code 429

#### Response Body - application/json

`JSON Object`

- **errorCode** (`string`): Rate limit error code.
  - `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

## Sample Response: HTTP 200

Paginated list of configured EDR exclusion rules

```json
{
  "metadata": {
    "limit": 25,
    "page": 3
  },
  "totalRecords": "51",
  "messageResponse": [
    {
      "value_transform": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
      "added_time": "1700012600000",
      "edrexclusiongrouptoexclusion_exclusion_group_id": "9000000000000003",
      "exclusion_group_id": "9000000000000003",
      "detection_source_transform": "Ransomware Engine",
      "alert_id_transform": "User-Applied",
      "exclusion_name_transform": "edr ex",
      "edrsuspiciousevent_sup_event_id": null,
      "last_modified_by": "1000000000000002",
      "last_updated_time_transform": "Jan 15, 2025 01:30 PM",
      "exclusion_id": "9000000000000002",
      "exclusion_exclusion_id": "9000000000000002",
      "first_name_transform": "John",
      "exclusion_types_transform": "Signer Certificate",
      "user_id": "1000000000000002",
      "process_execution_internal_name": "C:/example/process",
      "edr_config_id": "9000000000000001",
      "customer_id": "1000000000000001"
    }
  ],
  "totalPages": 3,
  "Links": {
    "next": "null",
    "prev": "/edr/api/view/exclusion?page=2&pageLimit=25"
  },
  "status": "success"
}
```

## Sample Response: HTTP 400

Unexpected server-side error

```json
{
  "errorMessage": "Exception while retrieving EDR exclusion list",
  "errorCode": "EDRCOMMON001"
}
```

## Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/view/exclusion",
  "errorMsg": "The URL /edr/api/view/exclusion was called too many times. Please retry after a while."
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.