---
type: api
title: Create an exception list item
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-createexceptionlistitem
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-createexceptionlistitem
products:
  - Kibana
---

# Create an exception list item

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/exception_lists/items`
- `POST` `/s/{space_id}/api/exception_lists/items`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create an exception item and associate it with the specified exception list.
> info
> Before creating exception items, you must create an exception list.

## Request Body

`application/json`

Exception list item's properties

One of:
- **CreateExceptionListItemGeneric**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — required
  - `list_id` (string · min: 1) — required
    The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

* `endpoint_list`: Elastic Endpoint exceptions list
* `endpoint_trusted_apps`: Trusted applications list
* `endpoint_trusted_devices`: Trusted devices list
* `endpoint_event_filters`: Event filters list
* `endpoint_host_isolation_exceptions`: Host isolation exceptions list
* `endpoint_blocklists`: Blocklist
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object) — optional
- **CreateExceptionListItemEndpointList**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — optional
  - `list_id` (enum) — required
    Values: `endpoint_list`
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedAppsWindows**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash, executable path, or code signature entries
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
    - **TrustedAppWindowsCodeSignatureEntry**
      - `entries` ([] union oneOf · min: 2 · max: 2) — required
        Must include exactly 2 entries - one for subject_name and one for trusted
        - **field: subject_name**
          - `field` (enum) — required
            Values: `subject_name`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (string) — required
            Certificate subject name
        - **field: trusted**
          - `field` (enum) — required
            Values: `trusted`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (enum) — required
            Must be the string 'true'
            Values: `true`
      - `field` (enum) — required
        Windows code signature field
        Values: `process.Ext.code_signature`
      - `type` (enum) — required
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Windows only
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedAppsMac**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash, executable path, or code signature entries
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
    - **TrustedAppMacCodeSignatureEntry**
      - `entries` ([] union oneOf · min: 2 · max: 2) — required
        Must include exactly 2 entries - one for subject_name and one for trusted
        - **field: subject_name**
          - `field` (enum) — required
            Values: `subject_name`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (string) — required
            Certificate subject name
        - **field: trusted**
          - `field` (enum) — required
            Values: `trusted`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (enum) — required
            Must be the string 'true'
            Values: `true`
      - `field` (enum) — required
        macOS code signature field
        Values: `process.code_signature`
      - `type` (enum) — required
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be macOS only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedAppsLinux**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash or executable path entries (code signature not supported on Linux)
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Linux only
    Values: `linux`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedDevicesWindows**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed)
    - `field` (enum) — required
      Device field to match against (user.name is Windows-only)
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`, `user.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Windows-only to allow username field
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedDevicesMac**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed)
    - `field` (enum) — required
      Device field to match against
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    macOS-only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemTrustedDevicesWindowsMac**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS)
    - `field` (enum) — required
      Device field to match against (username not available for multi-OS)
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 2 · max: 2) — optional
    Must include both Windows and macOS (username field not allowed)
    Values: `windows`, `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemEventFilters**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — optional
  - `list_id` (enum) — required
    Values: `endpoint_event_filters`
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemHostIsolation**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1 · max: 1) — optional
    Exactly one entry allowed for host isolation exceptions
    - `field` (enum) — required
      Must be destination.ip
      Values: `destination.ip`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match
      Values: `match`
    - `value` (string) — required
      Valid IPv4 address or CIDR notation (e.g., "192.168.1.1" or "10.0.0.0/8")
  - `list_id` (enum) — required
    Values: `endpoint_host_isolation_exceptions`
  - `os_types` ([] enum  · min: 3 · max: 3) — optional
    Must include all three operating systems (windows, linux, macos)
    Values: `windows`, `linux`, `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemBlocklistWindows**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
* Code signature entry: only 1 allowed
    - **BlocklistHashOrPathEntry**
      - `field` (enum) — required
        File hash or path field
        Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
      - `operator` (enum) — required
        Must be the value "included"
        Values: `included`
      - `type` (enum) — required
        Must be match_any for blocklists
        Values: `match_any`
      - `value` ([] string · min: 1) — required
        Array of hash values or file paths
    - **BlocklistWindowsCodeSignatureEntry**
      - `entries` ([] object · min: 1) — required
        Nested subject_name entries
        - `field` (enum) — required
          Certificate subject name
          Values: `subject_name`
        - `operator` (enum) — required
          Must be the value "included"
          Values: `included`
        - `type` (enum) — required
          Match type for subject name
          Values: `match`, `match_any`
        - `value` (union string | [] string) — required
      - `field` (enum) — required
        Windows code signature field
        Values: `file.Ext.code_signature`
      - `type` (enum) — required
        Must be nested for Windows code signature
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Windows-only
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemBlocklistLinux**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
    - `field` (enum) — required
      File hash or path field
      Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match_any for blocklists
      Values: `match_any`
    - `value` ([] string · min: 1) — required
      Array of hash values or file paths
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Linux-only
    Values: `linux`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **CreateExceptionListItemBlocklistMac**
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
    - `field` (enum) — required
      File hash or path field
      Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match_any for blocklists
      Values: `match_any`
    - `value` ([] string · min: 1) — required
      Array of hash values or file paths
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    macOS-only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)

## Responses

#### `200`

Successful response

`application/json`

- `_version` (string)
  The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
- `comments` ([] object)
  Array of comment fields:

- comment (string): Comments about the exception item.
  - `comment` (string · min: 1)
    A string that does not contain only whitespace characters
  - `created_at` (string)
    Autogenerated date of object creation.
  - `created_by` (string · min: 1)
    A string that does not contain only whitespace characters
  - `id` (string · min: 1)
    A string that does not contain only whitespace characters
  - `updated_at` (string)
    Autogenerated date of last object update.
  - `updated_by` (string · min: 1)
    A string that does not contain only whitespace characters
- `created_at` (string)
  Autogenerated date of object creation.
- `created_by` (string)
  Autogenerated value - user that created object.
- `description` (string)
  Describes the exception list.
- `entries` ([] object)
- `expire_time` (string)
  The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
- `id` (string · min: 1)
  Exception's identifier.
- `item_id` (string · min: 1)
  Human readable string identifier, e.g. `trusted-linux-processes`
- `list_id` (string · min: 1)
  The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

* `endpoint_list`: Elastic Endpoint exceptions list
* `endpoint_trusted_apps`: Trusted applications list
* `endpoint_trusted_devices`: Trusted devices list
* `endpoint_event_filters`: Event filters list
* `endpoint_host_isolation_exceptions`: Host isolation exceptions list
* `endpoint_blocklists`: Blocklist
- `meta` (object)
- `name` (string · min: 1)
  Exception list name.
- `namespace_type` (enum)
  Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
  Values: `agnostic`, `single`
- `os_types` ([] object)
  Values: `linux`, `macos`, `windows`
- `tags` ([] object)
- `tie_breaker_id` (string)
  Field used in search to ensure all containers are sorted and returned correctly.
- `type` (enum)
  Values: `simple`
- `updated_at` (string)
  Autogenerated date of last object update.
- `updated_by` (string)
  Autogenerated value - user that last updated object.
#### `400`

Invalid input data response

`application/json`

One of:
- **PlatformErrorResponse**
  - `error` (string)
  - `message` (string)
  - `statusCode` (integer)
- **SiemErrorResponse**
  - `message` (string)
  - `status_code` (integer)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `403`

Not enough privileges response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `409`

Exception list item already exists response

`application/json`

- `message` (string)
- `status_code` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code Examples

#### Console

```console
POST /api/exception_lists/items
{
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    }
  ],
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "type": "simple"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/exception_lists/items" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    }
  ],
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "type": "simple"
}'
```

## Response Examples

#### Autogenerated item id

```json
{
  "_version": "WzYsMV0=",
  "comments": [],
  "created_at": "2025-01-09T01:16:23.322Z",
  "created_by": "elastic",
  "description": "This is a sample exception that has no item_id so it is autogenerated.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    }
  ],
  "id": "323faa75-c657-4fa0-9084-8827612c207b",
  "item_id": "80e6edf7-4b13-4414-858f-2fa74aa52b37",
  "list_id": "8c1aae4c-1ef5-4bce-a2e3-16584b501783",
  "name": "Sample Autogenerated Exception List Item ID",
  "namespace_type": "single",
  "os_types": [],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "d6799986-3a23-4213-bc6d-ed9463a32f23",
  "type": "simple",
  "updated_at": "2025-01-09T01:16:23.322Z",
  "updated_by": "elastic"
}
```

#### Detection exception list item

```json
{
  "_version": "WzQsMV0=",
  "comments": [],
  "created_at": "2025-01-07T20:07:33.119Z",
  "created_by": "elastic",
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c",
  "type": "simple",
  "updated_at": "2025-01-07T20:07:33.119Z",
  "updated_by": "elastic"
}
```

#### With exist entry

```json
{
  "_version": "WzQsMV0=",
  "comments": [],
  "created_at": "2025-01-07T20:07:33.119Z",
  "created_by": "elastic",
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "excluded",
      "type": "exists"
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c",
  "type": "simple",
  "updated_at": "2025-01-07T20:07:33.119Z",
  "updated_by": "elastic"
}
```

#### With match any entry

```json
{
  "_version": "WzQsMV0=",
  "comments": [],
  "created_at": "2025-01-07T20:07:33.119Z",
  "created_by": "elastic",
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "host.name",
      "operator": "included",
      "type": "match_any",
      "value": [
        "saturn",
        "jupiter"
      ]
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c",
  "type": "simple",
  "updated_at": "2025-01-07T20:07:33.119Z",
  "updated_by": "elastic"
}
```

#### With match entry

```json
{
  "_version": "WzQsMV0=",
  "comments": [],
  "created_at": "2025-01-07T20:07:33.119Z",
  "created_by": "elastic",
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "field": "actingProcess.file.signer",
      "operator": "included",
      "type": "match",
      "value": "Elastic N.V."
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c",
  "type": "simple",
  "updated_at": "2025-01-07T20:07:33.119Z",
  "updated_by": "elastic"
}
```

#### With nested entry

```json
{
  "_version": "WzQsMV0=",
  "comments": [],
  "created_at": "2025-01-07T20:07:33.119Z",
  "created_by": "elastic",
  "description": "This is a sample detection type exception item.",
  "entries": [
    {
      "entries": [
        {
          "field": "signer",
          "operator": "included",
          "type": "match",
          "value": "Evil"
        },
        {
          "field": "trusted",
          "operator": "included",
          "type": "match",
          "value": true
        }
      ],
      "field": "file.signature",
      "type": "nested"
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Sample Exception List Item",
  "namespace_type": "single",
  "os_types": [
    "linux"
  ],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c",
  "type": "simple",
  "updated_at": "2025-01-07T20:07:33.119Z",
  "updated_by": "elastic"
}
```

#### With value list entry

```json
{
  "_version": "WzcsMV0=",
  "comments": [],
  "created_at": "2025-01-09T01:31:12.614Z",
  "created_by": "elastic",
  "description": "Don\u0027t signal when agent.name is rock01 and source.ip is in the goodguys.txt list",
  "entries": [
    {
      "field": "source.ip",
      "list": {
        "id": "goodguys.txt",
        "type": "ip"
      },
      "operator": "excluded",
      "type": "list"
    }
  ],
  "id": "deb26876-297d-4677-8a1f-35467d2f1c4f",
  "item_id": "686b129e-9b8d-4c59-8d8d-c93a9ea82c71",
  "list_id": "8c1aae4c-1ef5-4bce-a2e3-16584b501783",
  "name": "Filter out good guys ip and agent.name rock01",
  "namespace_type": "single",
  "os_types": [],
  "tags": [
    "malware"
  ],
  "tie_breaker_id": "5e0288ce-6657-4c18-9dcc-00ec9e8cc6c8",
  "type": "simple",
  "updated_at": "2025-01-09T01:31:12.614Z",
  "updated_by": "elastic"
}
```

#### Bad

```json
{
  "error": "Bad Request,",
  "message": "[request body]: list_id: Expected string, received number",
  "statusCode": "400,"
}
```

#### Unauthorized

```json
{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
```

#### Forbidden

```json
{
  "error": "Forbidden",
  "message": "API [POST /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}
```

#### Already exists

```json
{
  "message": "exception list item id: \\\u0022simple_list_item\\\u0022 already exists",
  "status_code": 409
}
```

#### Server error

```json
{
  "message": "Internal Server Error",
  "status_code": 500
}
```