APIs
  • Kibana APIs
    Back to hub Cloud Billing API Elastic Cloud API Elastic Cloud Connected API Elastic Cloud Enterprise API Elastic Cloud Serverless API Elasticsearch API Elasticsearch Serverless API Kibana APIs Kibana Serverless APIs Logstash APIs
  • Download source
    JSON YAML
  1. APIs /
  2. Kibana APIs

Security Elastic Endpoint exceptions

View as Markdown

Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.

6 endpoints

  • Create an Elastic Endpoint rule exception list
    • POST /api/endpoint_list
  • Delete an Elastic Endpoint exception list item
    • DELETE /api/endpoint_list/items
  • Get an Elastic Endpoint rule exception list item
    • GET /api/endpoint_list/items
  • Create an Elastic Endpoint rule exception list item
    • POST /api/endpoint_list/items
  • Update an Elastic Endpoint rule exception list item
    • PUT /api/endpoint_list/items
  • Get Elastic Endpoint exception list items
    • GET /api/endpoint_list/items/_find
v8
latest v9 v8 v0
  • Spaces
  • Authentication
  • Servers

  • Alerting
    • Get the alerting framework health GET
    • Get the alerting framework health GET
    • Get the rule types GET
    • Delete a rule DELETE
    • Get rule details GET
    • Create a rule POST
    • Update a rule PUT
    • Disable a rule POST
    • Enable a rule POST
    • Mute all alerts POST
    • Unmute all alerts POST
    • Update the API key for a rule POST
    • Schedule a snooze for the rule POST
    • Mute an alert POST
    • Unmute an alert POST
    • Delete a snooze schedule for a rule DELETE
    • Get information about rules GET
    • Delete an alert DELETE
    • Get an alert by identifier GET
    • Create an alert POST
    • Update an alert PUT
    • Disable an alert POST
    • Enable an alert POST
    • Mute all alert instances POST
    • Unmute all alert instances POST
    • Mute an alert instance POST
    • Unmute an alert instance POST
    • Get a paginated set of alerts GET
    • Get the alert types GET
  • APM agent configuration
    • Delete agent configuration DELETE
    • Get a list of agent configurations GET
    • Create or update agent configuration PUT
    • Get agent name for service GET
    • Get environments for service GET
    • Lookup single agent configuration POST
    • Get single agent configuration GET
  • APM agent keys
    • Create an APM agent key POST
  • APM annotations
    • Create a service annotation POST
    • Search for annotations GET
  • APM server schema
    • Save APM server schema POST
  • APM sourcemaps
    • Get source maps GET
    • Upload source map POST
    • Delete source map DELETE
  • Cases
    • Delete cases DELETE
    • Update cases PATCH
    • Create a case POST
    • Search cases GET
    • Get case information GET
    • Get all alerts for a case GET
    • Delete all case comments and alerts DELETE
    • Get all case comments GET
    • Update a case comment or alert PATCH
    • Add a case comment or alert POST
    • Find case comments and alerts GET
    • Delete a case comment or alert DELETE
    • Get a case comment or alert GET
    • Push a case to an external service POST
    • Attach a file to a case POST
    • Get case activity GET
    • Find case activity GET
    • Get cases for an alert GET
    • Get case settings GET
    • Add case settings POST
    • Update case settings PATCH
    • Get case connectors GET
    • Get case creators GET
    • Get case status summary GET
    • Get case tags GET
  • Connectors
    • Get all connectors GET
    • Get all connectors GET
    • Create a connector POST
    • Create a connector POST
    • Delete a connector DELETE
    • Delete a connector DELETE
    • Get connector information GET
    • Get connector information GET
    • Update a connector PUT
    • Update a connector PUT
    • Run a connector POST
    • Run a connector POST
    • Get connector types GET
    • Get connector types GET
  • Data streams
    • List data streams GET
  • Data views
    • Get all data views GET
    • Create a data view POST
    • Delete a data view DELETE
    • Get a data view GET
    • Update a data view POST
    • Update data view fields metadata POST
    • Create a runtime field POST
    • Create or update a runtime field PUT
    • Delete a runtime field from a data view DELETE
    • Get a runtime field GET
    • Update a runtime field POST
    • Get the default data view GET
    • Set the default data view POST
    • Swap saved object references POST
    • Preview a saved object reference swap POST
  • Elastic Agent actions
    • Create agent action POST
    • Get agent action status GET
    • Cancel agent action POST
  • Elastic Agent binary download sources
    • List agent binary download sources GET
    • Create agent binary download source POST
    • Delete agent binary download source by ID DELETE
    • Get agent binary download source by ID GET
    • Update agent binary download source by ID PUT
  • Elastic Agent policies
    • List agent policies GET
    • Create agent policy POST
    • Bulk get agent policies POST
    • Get agent policy by ID GET
    • Update agent policy by ID PUT
    • Copy agent policy by ID POST
    • Download agent policy by ID GET
    • Get full agent policy by ID GET
    • Delete agent policy by ID POST
  • Elastic Agent status
    • Get agent status summary GET
    • Get agent status summary GET
    • Get incoming agent data GET
  • Elastic Agents
    • List agents GET
    • List agents by action ids POST
    • Delete agent by ID DELETE
    • Get agent by ID GET
    • Update agent by ID PUT
    • Reassign agent POST
    • Reassign agent PUT
    • Request agent diagnostics POST
    • Unenroll agent POST
    • Upgrade agent POST
    • List agent uploads GET
    • Bulk reassign agents POST
    • Bulk request diagnostics from agents POST
    • Bulk unenroll agents POST
    • Bulk update agent tags POST
    • Bulk upgrade agents POST
    • Delete file uploaded by agent DELETE
    • Get file uploaded by agent GET
    • Get agent setup info GET
    • Initiate agent setup POST
    • List agent tags GET
  • Elastic Package Manager (EPM)
    • Bulk get assets POST
    • List package categories GET
    • List packages GET
    • Install by package by direct upload POST
    • Bulk install packages POST
    • Delete ackage DELETE
    • Get package GET
    • Get package GET
    • Install package POST
    • Install package POST
    • Delete package DELETE
    • Update package settings PUT
    • Get package file GET
    • Authorize transforms POST
    • Get package stats GET
    • Get limited package list GET
    • Get inputs template GET
    • Get package signature verification key ID GET
  • Fleet enrollment API keys
    • List enrollment API keys GET
    • List enrollment API keys GET
    • Create enrollment API key POST
    • Create enrollment API key POST
    • Revoke enrollment API key by ID by marking it as inactive DELETE
    • Get enrollment API key by ID GET
    • Get enrollment API key by ID GET
    • Delete enrollment API key by ID DELETE
  • Fleet internals
    • Fleet Server health check POST
    • Get settings GET
    • Update settings PUT
    • Initiate Fleet setup POST
  • Fleet Kubernetes
    • Get full K8s agent manifest GET
  • Fleet outputs
    • Generate Logstash API key POST
    • List outputs GET
    • Create output POST
    • Delete output by ID DELETE
    • Get output by ID GET
    • Update output by ID PUT
    • Get latest output health GET
  • Fleet package policies
    • List package policies GET
    • Create package policy POST
    • Bulk get package policies POST
    • Delete package policy by ID DELETE
    • Get package policy by ID GET
    • Update package policy by ID PUT
    • Delete package policy POST
    • Upgrade package policy to a newer package version POST
    • Dry run package policy upgrade POST
  • Fleet proxies
    • List proxies GET
    • Create proxy POST
    • Delete proxy by ID DELETE
    • Get proxy by ID GET
    • Update proxy by ID PUT
  • Fleet Server hosts
    • List Fleet Server hosts GET
    • Create Fleet Server host POST
    • Delete Fleet Server host by ID DELETE
    • Get Fleet Server host by ID GET
    • Update Fleet Server host by ID PUT
  • Fleet service tokens
    • Create service token POST
    • Create service token POST
  • Fleet uninstall tokens
    • List metadata for latest uninstall tokens per agent policy GET
    • Get one decrypted uninstall token by its ID GET
  • Logstash configuration management
    • Delete a Logstash pipeline DELETE
    • Get a Logstash pipeline GET
    • Create or update a Logstash pipeline PUT
    • Get all Logstash pipelines GET
  • Machine learning
    • Sync saved objects in the default space GET
  • Maintenance windows
    • Create a maintenance window. POST
    • Delete a maintenance window. DELETE
    • Get maintenance window details. GET
    • Update a maintenance window. PATCH
    • Archive a maintenance window. POST
    • Unarchive a maintenance window. POST
  • Roles
    • Get all roles GET
    • Delete a role DELETE
    • Get a role GET
    • Create or update a role PUT
    • Create or update roles POST
  • Saved objects
    • Rotate a key for encrypted saved objects POST
    • Create saved objects POST
    • Delete saved objects POST
    • Get saved objects POST
    • Resolve saved objects POST
    • Update saved objects POST
    • Export saved objects POST
    • Search for saved objects GET
    • Import saved objects POST
    • Resolve import errors POST
    • Create a saved object POST
    • Create a saved object POST
    • Get a saved object GET
    • Update a saved object PUT
    • Resolve a saved object GET
  • Security AI assistant
    • Apply a bulk action to anonymization fields POST
    • Get anonymization fields GET
    • Create a model response POST
    • Delete conversations DELETE
    • Create a conversation POST
    • Get conversations GET
    • Delete a conversation DELETE
    • Get a conversation GET
    • Update a conversation PUT
    • Read a KnowledgeBase GET
    • Create a KnowledgeBase POST
    • Create a Knowledge Base Entry POST
    • Applies a bulk action to multiple Knowledge Base Entries POST
    • Finds Knowledge Base Entries that match the given query. GET
    • Deletes a single Knowledge Base Entry using the `id` field DELETE
    • Read a Knowledge Base Entry GET
    • Update a Knowledge Base Entry PUT
    • Apply a bulk action to prompts POST
    • Get prompts GET
  • Security detections
    • Delete an alerts index DELETE
    • Reads the alert index name if it exists GET
    • Create an alerts index POST
    • Returns user privileges for the Kibana space GET
    • Delete a detection rule DELETE
    • Retrieve a detection rule GET
    • Patch a detection rule PATCH
    • Create a detection rule POST
    • Update a detection rule PUT
    • Apply a bulk action to detection rules POST
    • Create multiple detection rules POST
    • Delete multiple detection rules POST
    • Patch multiple detection rules PATCH
    • Update multiple detection rules PUT
    • Export detection rules POST
    • List all detection rules GET
    • Import detection rules POST
    • Install prebuilt detection rules and Timelines PUT
    • Retrieve the status of prebuilt detection rules and Timelines GET
    • Preview rule alerts generated on specified time range POST
    • Assign and unassign users from detection alerts POST
    • Finalize detection alert migrations POST
    • Clean up detection alert migrations DELETE
    • Initiate a detection alert migration POST
    • Retrieve the status of detection alert migrations POST
    • Find and/or aggregate detection alerts POST
    • Set a detection alert status POST
    • Add and remove detection alert tags POST
    • List all detection rule tags GET
  • Security Elastic Endpoint exceptions
    • Create an Elastic Endpoint rule exception list POST
    • Delete an Elastic Endpoint exception list item DELETE
    • Get an Elastic Endpoint rule exception list item GET
    • Create an Elastic Endpoint rule exception list item POST
    • Update an Elastic Endpoint rule exception list item PUT
    • Get Elastic Endpoint exception list items GET
  • Security endpoint management
    • Get response actions GET
    • Get an action request log GET
    • Get response actions status GET
    • Get action details GET
    • Get file information GET
    • Download a file GET
    • Run a command POST
    • Get a file POST
    • Isolate an endpoint POST
    • Isolate an endpoint POST
    • Terminate a process POST
    • Get running processes POST
    • Run a script POST
    • Scan a file or directory POST
    • Get actions state GET
    • Suspend a process POST
    • Release an isolated endpoint POST
    • Release an isolated endpoint POST
    • Upload a file POST
    • Get a metadata list GET
    • Get metadata GET
    • Get metadata transforms GET
    • Get a policy response GET
    • Get an agent policy summary GET
    • Get a protection updates note GET
    • Create or update a protection updates note POST
    • Get suggestions POST
  • Security entity analytics
    • Delete an asset criticality record DELETE
    • Get an asset criticality record GET
    • Upsert an asset criticality record POST
    • Bulk upsert asset criticality records POST
    • List asset criticality records GET
    • Initialize the Entity Store POST
    • List the Entity Engines GET
    • Delete the Entity Engine DELETE
    • Get an Entity Engine GET
    • Initialize an Entity Engine POST
    • Start an Entity Engine POST
    • Stop an Entity Engine POST
    • Apply DataView indices to all installed engines POST
    • List Entity Store Entities GET
    • Get the status of the Entity Store GET
    • Cleanup the Risk Engine DELETE
    • Configure the Risk Engine Saved Object PATCH
    • Run the risk scoring engine POST
  • Security exceptions
    • Exceptions requirements
    • Create rule exception list items POST
    • Delete an exception list DELETE
    • Get exception list details GET
    • Create an exception list POST
    • Update an exception list PUT
    • Duplicate an exception list POST
    • Export an exception list POST
    • Get exception lists GET
    • Import an exception list POST
    • Delete an exception list item DELETE
    • Get an exception list item GET
    • Create an exception list item POST
    • Update an exception list item PUT
    • Get exception list items GET
    • Get an exception list summary GET
    • Create a shared exception list POST
  • Security lists
    • Lists requirements
    • Delete a list DELETE
    • Get list details GET
    • Patch a list PATCH
    • Create a list POST
    • Update a list PUT
    • Get lists GET
    • Delete list data streams DELETE
    • Get status of list data streams GET
    • Create list data streams POST
    • Delete a list item DELETE
    • Get a list item GET
    • Patch a list item PATCH
    • Create a list item POST
    • Update a list item PUT
    • Export list items POST
    • Get list items GET
    • Import list items POST
    • Get list privileges GET
  • Security Osquery
    • Get live queries GET
    • Create a live query POST
    • Get live query details GET
    • Get live query results GET
    • Get packs GET
    • Create a pack POST
    • Delete a pack DELETE
    • Get pack details GET
    • Update a pack PUT
    • Get saved queries GET
    • Create a saved query POST
    • Delete a saved query DELETE
    • Get saved query details GET
    • Update a saved query PUT
  • Security timeline
    • Delete a note DELETE
    • Get notes GET
    • Add or update a note PATCH
    • Pin/unpin an event PATCH
    • Delete Timelines or Timeline templates DELETE
    • Get Timeline or Timeline template details GET
    • Update a Timeline PATCH
    • Create a Timeline or Timeline template POST
    • Copies timeline or timeline template GET
    • Get draft Timeline or Timeline template details GET
    • Create a clean draft Timeline or Timeline template POST
    • Export Timelines POST
    • Favorite a Timeline or Timeline template PATCH
    • Import Timelines POST
    • Install prepackaged Timelines POST
    • Get an existing saved Timeline or Timeline template GET
    • Get Timelines or Timeline templates GET
  • Service level objectives
    • Get a paginated list of SLOs GET
    • Create an SLO POST
    • Bulk delete SLO definitions and their associated summary and rollup data. POST
    • Retrieve the status of the bulk deletion GET
    • Batch delete rollup and summary data POST
    • Batch delete rollup and summary data POST
    • Delete an SLO DELETE
    • Get an SLO GET
    • Update an SLO PUT
    • Reset an SLO POST
    • Disable an SLO POST
    • Enable an SLO POST
    • Get the SLO definitions GET
  • Short URLs
    • Create a short URL POST
    • Resolve a short URL GET
    • Delete a short URL DELETE
    • Get a short URL GET
  • Spaces
    • Copy saved objects between spaces POST
    • Disable legacy URL aliases POST
    • Get shareable references POST
    • Update saved objects in spaces POST
    • Get all spaces GET
    • Create a space POST
    • Delete a space DELETE
    • Get a space GET
    • Update a space PUT
  • Synthetics
    • Get monitors GET
    • Create a monitor POST
    • Delete monitors POST
    • Delete a monitor DELETE
    • Get a monitor GET
    • Update a monitor PUT
    • Get parameters GET
    • Add parameters POST
    • Delete parameters POST
    • Delete a parameter DELETE
    • Get a parameter GET
    • Update a parameter PUT
    • Get private locations GET
    • Create a private location POST
    • Delete a private location DELETE
    • Get a private location GET
    • Update a private location PUT
  • System
    • Get Kibana's current status GET
  • Task manager
    • Get the task manager health GET
  • unknown
    • Query roles POST
    • Resolve conflicts copying saved objects POST
  • Upgrade assistant
    • Get the reindex status GET
    • Start or resume reindexing POST
    • Cancel reindexing POST
    • Batch start or resume reindexing POST
    • Get the batch reindex queue GET
    • Get the upgrade readiness status GET
  • Uptime
    • Get uptime settings GET
    • Update uptime settings PUT
  • User session management
    • Invalidate user sessions POST
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Notice at Collection | Your Privacy Choices