---
type: api
title: Update an exception list item
description: Update an exception list item using the `id` or `item_id` field.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-updateexceptionlistitem
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-updateexceptionlistitem
products:
  - Kibana
---

# Update an exception list item

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/exception_lists/items`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

Update an exception list item using the `id` or `item_id` field.

## Request Body

`application/json`

Exception list item's properties

One of:
- **UpdateExceptionListItemGeneric**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — required
  - `list_id` (string · min: 1) — optional
    The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

* `endpoint_list`: Elastic Endpoint exceptions list
* `endpoint_trusted_apps`: Trusted applications list
* `endpoint_trusted_devices`: Trusted devices list
* `endpoint_event_filters`: Event filters list
* `endpoint_host_isolation_exceptions`: Host isolation exceptions list
* `endpoint_blocklists`: Blocklist
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object) — optional
- **UpdateExceptionListItemEndpointList**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — optional
  - `list_id` (enum) — required
    Values: `endpoint_list`
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedAppsWindows**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash, executable path, or code signature entries
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
    - **TrustedAppWindowsCodeSignatureEntry**
      - `entries` ([] union oneOf · min: 2 · max: 2) — required
        Must include exactly 2 entries - one for subject_name and one for trusted
        - **field: subject_name**
          - `field` (enum) — required
            Values: `subject_name`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (string) — required
            Certificate subject name
        - **field: trusted**
          - `field` (enum) — required
            Values: `trusted`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (enum) — required
            Must be the string 'true'
            Values: `true`
      - `field` (enum) — required
        Windows code signature field
        Values: `process.Ext.code_signature`
      - `type` (enum) — required
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Windows only
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedAppsMac**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash, executable path, or code signature entries
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
    - **TrustedAppMacCodeSignatureEntry**
      - `entries` ([] union oneOf · min: 2 · max: 2) — required
        Must include exactly 2 entries - one for subject_name and one for trusted
        - **field: subject_name**
          - `field` (enum) — required
            Values: `subject_name`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (string) — required
            Certificate subject name
        - **field: trusted**
          - `field` (enum) — required
            Values: `trusted`
          - `operator` (enum) — required
            Values: `included`
          - `type` (enum) — required
            Values: `match`
          - `value` (enum) — required
            Must be the string 'true'
            Values: `true`
      - `field` (enum) — required
        macOS code signature field
        Values: `process.code_signature`
      - `type` (enum) — required
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be macOS only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedAppsLinux**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    Process hash or executable path entries (code signature not supported on Linux)
    - **TrustedAppHashEntry**
      - `field` (enum) — required
        Process hash field
        Values: `process.hash.md5`, `process.hash.sha1`, `process.hash.sha256`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Hash entries only support match type
        Values: `match`
      - `value` (string) — required
        Hash value (MD5, SHA1, or SHA256)
    - **TrustedAppPathEntry**
      - `field` (enum) — required
        Process executable path field
        Values: `process.executable.caseless`
      - `operator` (enum) — required
        Values: `included`
      - `type` (enum) — required
        Path supports both match and wildcard types
        Values: `match`, `wildcard`
      - `value` (string) — required
        Executable path
  - `list_id` (enum) — required
    Values: `endpoint_trusted_apps`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Linux only
    Values: `linux`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedDevicesWindows**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed)
    - `field` (enum) — required
      Device field to match against (user.name is Windows-only)
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`, `user.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Must be Windows-only to allow username field
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedDevicesMac**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed)
    - `field` (enum) — required
      Device field to match against
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    macOS-only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemTrustedDevicesWindowsMac**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS)
    - `field` (enum) — required
      Device field to match against (username not available for multi-OS)
      Values: `device.serial_number`, `device.type`, `host.name`, `device.vendor.name`, `device.vendor.id`, `device.product.id`, `device.product.name`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Entry match type
      Values: `match`, `wildcard`, `match_any`
    - `value` (union string | [] string) — required
  - `list_id` (enum) — required
    Values: `endpoint_trusted_devices`
  - `os_types` ([] enum  · min: 2 · max: 2) — optional
    Must include both Windows and macOS (username field not allowed)
    Values: `windows`, `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemEventFilters**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object) — optional
  - `list_id` (enum) — required
    Values: `endpoint_event_filters`
  - `os_types` ([] object) — optional
    Values: `linux`, `macos`, `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemHostIsolation**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1 · max: 1) — optional
    Exactly one entry allowed for host isolation exceptions
    - `field` (enum) — required
      Must be destination.ip
      Values: `destination.ip`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match
      Values: `match`
    - `value` (string) — required
      Valid IPv4 address or CIDR notation (e.g., "192.168.1.1" or "10.0.0.0/8")
  - `list_id` (enum) — required
    Values: `endpoint_host_isolation_exceptions`
  - `os_types` ([] enum  · min: 3 · max: 3) — optional
    Must include all three operating systems (windows, linux, macos)
    Values: `windows`, `linux`, `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemBlocklistWindows**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] union oneOf · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
* Code signature entry: only 1 allowed
    - **BlocklistHashOrPathEntry**
      - `field` (enum) — required
        File hash or path field
        Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
      - `operator` (enum) — required
        Must be the value "included"
        Values: `included`
      - `type` (enum) — required
        Must be match_any for blocklists
        Values: `match_any`
      - `value` ([] string · min: 1) — required
        Array of hash values or file paths
    - **BlocklistWindowsCodeSignatureEntry**
      - `entries` ([] object · min: 1) — required
        Nested subject_name entries
        - `field` (enum) — required
          Certificate subject name
          Values: `subject_name`
        - `operator` (enum) — required
          Must be the value "included"
          Values: `included`
        - `type` (enum) — required
          Match type for subject name
          Values: `match`, `match_any`
        - `value` (union string | [] string) — required
      - `field` (enum) — required
        Windows code signature field
        Values: `file.Ext.code_signature`
      - `type` (enum) — required
        Must be nested for Windows code signature
        Values: `nested`
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Windows-only
    Values: `windows`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemBlocklistLinux**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
    - `field` (enum) — required
      File hash or path field
      Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match_any for blocklists
      Values: `match_any`
    - `value` ([] string · min: 1) — required
      Array of hash values or file paths
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    Linux-only
    Values: `linux`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)
- **UpdateExceptionListItemBlocklistMac**
  - `_version` (string) — optional
    The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
  - `comments` ([] object) — optional
    - `comment` (string · min: 1) — required
      A string that does not contain only whitespace characters
    - `id` (string · min: 1) — optional
      A string that does not contain only whitespace characters
  - `description` (string) — required
    Describes the exception list.
  - `expire_time` (string) — optional
    The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
  - `id` (string · min: 1) — optional
    Exception's identifier.
  - `item_id` (string · min: 1) — optional
    Human readable string identifier, e.g. `trusted-linux-processes`
  - `meta` (object) — optional
  - `name` (string · min: 1) — required
    Exception list name.
  - `namespace_type` (enum) — optional
    Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
    Values: `agnostic`, `single`
  - `type` (enum) — required
    Values: `simple`
  - `entries` ([] object · min: 1) — optional
    **Validation rules:**
* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)
* Path entry: only 1 allowed
    - `field` (enum) — required
      File hash or path field
      Values: `file.hash.md5`, `file.hash.sha1`, `file.hash.sha256`, `file.path`, `file.path.caseless`
    - `operator` (enum) — required
      Must be the value "included"
      Values: `included`
    - `type` (enum) — required
      Must be match_any for blocklists
      Values: `match_any`
    - `value` ([] string · min: 1) — required
      Array of hash values or file paths
  - `list_id` (enum) — required
    Values: `endpoint_blocklists`
  - `os_types` ([] enum  · min: 1 · max: 1) — optional
    macOS-only
    Values: `macos`
  - `tags` ([] object · default: []) — optional
    Tags for categorization. Special tags for scope control:
* `"policy:all"` - Global artifact (applies to all Elastic Defend policies)
* `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)

## Responses

#### `200`

Successful response

`application/json`

- `_version` (string)
  The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
- `comments` ([] object)
  Array of comment fields:

- comment (string): Comments about the exception item.
  - `comment` (string · min: 1)
    A string that does not contain only whitespace characters
  - `created_at` (string)
    Autogenerated date of object creation.
  - `created_by` (string · min: 1)
    A string that does not contain only whitespace characters
  - `id` (string · min: 1)
    A string that does not contain only whitespace characters
  - `updated_at` (string)
    Autogenerated date of last object update.
  - `updated_by` (string · min: 1)
    A string that does not contain only whitespace characters
- `created_at` (string)
  Autogenerated date of object creation.
- `created_by` (string)
  Autogenerated value - user that created object.
- `description` (string)
  Describes the exception list.
- `entries` ([] object)
- `expire_time` (string)
  The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
- `id` (string · min: 1)
  Exception's identifier.
- `item_id` (string · min: 1)
  Human readable string identifier, e.g. `trusted-linux-processes`
- `list_id` (string · min: 1)
  The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

* `endpoint_list`: Elastic Endpoint exceptions list
* `endpoint_trusted_apps`: Trusted applications list
* `endpoint_trusted_devices`: Trusted devices list
* `endpoint_event_filters`: Event filters list
* `endpoint_host_isolation_exceptions`: Host isolation exceptions list
* `endpoint_blocklists`: Blocklist
- `meta` (object)
- `name` (string · min: 1)
  Exception list name.
- `namespace_type` (enum)
  Determines whether the exception container is available in all Kibana spaces or just the space
in which it is created, where:

- `single`: Only available in the Kibana space in which it is created.
- `agnostic`: Available in all Kibana spaces.

For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.
  Values: `agnostic`, `single`
- `os_types` ([] object)
  Values: `linux`, `macos`, `windows`
- `tags` ([] object)
- `tie_breaker_id` (string)
  Field used in search to ensure all containers are sorted and returned correctly.
- `type` (enum)
  Values: `simple`
- `updated_at` (string)
  Autogenerated date of last object update.
- `updated_by` (string)
  Autogenerated value - user that last updated object.
#### `400`

Invalid input data response

`application/json`

One of:
- **PlatformErrorResponse**
  - `error` (string)
  - `message` (string)
  - `statusCode` (integer)
- **SiemErrorResponse**
  - `message` (string)
  - `status_code` (integer)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `403`

Not enough privileges response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `404`

Exception list item not found response

`application/json`

- `message` (string)
- `status_code` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code Examples

#### Console

```console
PUT /api/exception_lists/items
{
  "description": "Updated description",
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "name": "Updated name",
  "namespace_type": "single",
  "type": "simple"
}
```

#### curl

```curl
curl -X PUT "https://{kibana_url}/api/exception_lists/items" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Updated description",
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "name": "Updated name",
  "namespace_type": "single",
  "type": "simple"
}'
```

## Response Examples

#### Simple list item

```json
{
  "_version": "WzEyLDFd",
  "comments": [],
  "created_at": "2025-01-07T21:12:25.512Z",
  "created_by": "elastic",
  "description": "Updated description",
  "entries": [
    {
      "field": "host.name",
      "operator": "included",
      "type": "match",
      "value": "rock01"
    }
  ],
  "id": "459c5e7e-f8b2-4f0b-b136-c1fc702f72da",
  "item_id": "simple_list_item",
  "list_id": "simple_list",
  "name": "Updated name",
  "namespace_type": "single",
  "os_types": [],
  "tags": [],
  "tie_breaker_id": "ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0",
  "type": "simple",
  "updated_at": "2025-01-07T21:34:50.233Z",
  "updated_by": "elastic"
}
```

#### Bad

```json
{
  "error": "Bad Request",
  "message": "[request body]: item_id: Expected string, received number",
  "statusCode": 400
}
```

#### Unauthorized

```json
{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
```

#### Forbidden

```json
{
  "error": "Forbidden",
  "message": "API [PUT /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}
```

#### Not found

```json
{
  "message": "exception list item item_id: \\\u0022foo\\\u0022 does not exist",
  "status_code": 404
}
```

#### Server error

```json
{
  "message": "Internal Server Error",
  "status_code": 500
}
```