openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Exceptions API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: 'Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule''s other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.


    Exceptions are made up of:


    * **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.

    * **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item''s query evaluates to `true`, the rule does not generate an alert.


    For detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.

    > info

    > You cannot use lists with endpoint rule exceptions.


    > info

    > Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.


    ## Exceptions requirements


    Before you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).

    '
  name: Security Exceptions API
  x-displayName: Security exceptions
paths:
  /api/detection_engine/rules/{id}/exceptions:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/{id}/exceptions</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create exception items that apply to a single detection rule.'
      operationId: CreateRuleExceptionListItems
      parameters:
      - description: Detection rule's identifier
        examples:
          id:
            value: 330bdd28-eedf-40e1-bed0-f10176c7f9e0
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_UUID'
      requestBody:
        content:
          application/json:
            examples:
              addItems:
                value:
                  items:
                  - description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    - field: host.name
                      operator: included
                      type: match_any
                      value:
                      - saturn
                      - jupiter
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    type: simple
            schema:
              example:
                items:
                - description: This is a sample detection type exception item.
                  entries:
                  - field: actingProcess.file.signer
                    operator: excluded
                    type: exists
                  - field: host.name
                    operator: included
                    type: match_any
                    value:
                    - saturn
                    - jupiter
                  item_id: simple_list_item
                  list_id: simple_list
                  name: Sample Exception List Item
                  namespace_type: single
                  os_types:
                  - linux
                  tags:
                  - malware
                  type: simple
              type: object
              properties:
                items:
                  items:
                    $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemProps'
                  type: array
              required:
              - items
        description: Rule exception items.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ruleExceptionItems:
                  value:
                  - _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    - field: host.name
                      operator: included
                      type: match_any
                      value:
                      - saturn
                      - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
              schema:
                items:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badPayload:
                  value:
                    error: Bad Request
                    message: Invalid request payload JSON format
                    statusCode: 400
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request params]: id: Invalid uuid'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create rule exception items
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete an exception list using the `id` or `list_id` field.'
      operationId: DeleteExceptionList
      parameters:
      - description: Exception list's identifier. Either `id` or `list_id` must be specified.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
      - description: Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.
        examples:
          autogeneratedId:
            value: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
          list_id:
            value: simple_list
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      - description: '`single` deletes the list in the current Kibana space; `agnostic` deletes a global list. Must match the

          list you are removing when using `list_id` or `id`.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionExceptionList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of an exception list using the `id` or `list_id` field.'
      operationId: ReadExceptionList
      parameters:
      - description: Exception list's identifier. Either `id` or `list_id` must be specified.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
      - description: Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      - description: 'When `single`, the list is resolved in the current Kibana space. When `agnostic`, the list is a global

          (space-agnostic) container. Required for looking up the correct list when `list_id` is not unique.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionType:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception list details
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        An exception list groups exception items and can be associated with detection rules. You can assign exception lists to multiple detection rules.

        > info

        > All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.

        '
      operationId: CreateExceptionList
      requestBody:
        content:
          application/json:
            examples:
              createDetection:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                  - linux
                  tags:
                  - malware
                  type: detection
            schema:
              example:
                description: This is a sample detection type exception list.
                list_id: simple_list
                name: Sample Detection Exception List
                namespace_type: single
                os_types:
                - linux
                tags:
                - malware
                type: detection
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                  default: single
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                  default: []
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
                  default: 1
              required:
              - name
              - description
              - type
        description: Exception list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                autogeneratedListId:
                  value:
                    _version: WzMsMV0=
                    created_at: '2025-01-09T01:05:23.019Z'
                    created_by: elastic
                    description: This is a sample detection type exception with an autogenerated list_id.
                    id: 28243c2f-624a-4443-823d-c0b894880931
                    immutable: false
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types: []
                    tags:
                    - malware
                    tie_breaker_id: ad94de31-39f7-4ad7-b8e4-988bfa95f338
                    type: detection
                    updated_at: '2025-01-09T01:05:23.020Z'
                    updated_by: elastic
                    version: 1
                namespaceAgnostic:
                  value:
                    _version: WzUsMV0=
                    created_at: '2025-01-09T01:10:36.369Z'
                    created_by: elastic
                    description: This is a sample agnostic endpoint type exception.
                    id: 1a744e77-22ca-4b6b-9085-54f55275ebe5
                    immutable: false
                    list_id: b935eb55-7b21-4c1c-b235-faa1df23b3d6
                    name: Sample Agnostic Endpoint Exception List
                    namespace_type: agnostic
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 49ea0adc-a2b8-4d83-a8f3-2fb98301dea3
                    type: endpoint
                    updated_at: '2025-01-09T01:10:36.369Z'
                    updated_by: elastic
                    version: 1
                typeDetection:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
                typeEndpoint:
                  value:
                    _version: WzQsMV0=
                    created_at: '2025-01-09T01:07:49.658Z'
                    created_by: elastic
                    description: This is a sample endpoint type exception list.
                    id: a79f4730-6e32-4278-abfc-349c0add7d54
                    immutable: false
                    list_id: endpoint_list
                    name: Sample Endpoint Exception List
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 94a028af-8f47-427a-aca5-ffaf829e64ee
                    type: endpoint
                    updated_at: '2025-01-09T01:07:49.658Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update an exception list using the `id` or `list_id` field.'
      operationId: UpdateExceptionList
      requestBody:
        content:
          application/json:
            examples:
              fullReplace:
                value:
                  description: Different description
                  list_id: simple_list
                  name: Updated exception list name
                  os_types:
                  - linux
                  tags:
                  - draft
                  - malware
                  type: detection
            schema:
              example:
                description: Different description
                list_id: simple_list
                name: Updated exception list name
                os_types:
                - linux
                tags:
                - draft malware
                type: detection
              type: object
              properties:
                _version:
                  description: The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
                  type: string
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                  default: single
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                  default: []
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
              required:
              - name
              - description
              - type
        description: Exception list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleList:
                  value:
                    _version: WzExLDFd
                    created_at: '2025-01-07T20:43:55.264Z'
                    created_by: elastic
                    description: Different description
                    id: fa7f545f-191b-4d32-b1f0-c7cd62a79e55
                    immutable: false
                    list_id: simple_list
                    name: Updated exception list name
                    namespace_type: single
                    os_types: []
                    tags:
                    - draft malware
                    tie_breaker_id: 319fe983-acdd-4806-b6c4-3098eae9392f
                    type: detection
                    updated_at: '2025-01-07T21:32:03.726Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/_duplicate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_duplicate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Duplicate an existing exception list.'
      operationId: DuplicateExceptionList
      parameters:
      - description: The `list_id` of the existing exception list to copy (source list).
        in: query
        name: list_id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      - description: Scope in which the source list is defined (`single` = current space, `agnostic` = all spaces).
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
      - description: Determines whether to include expired exceptions in the duplicated list. Expiration date defined by `expire_time`.
        in: query
        name: include_expired_exceptions
        required: true
        schema:
          default: 'true'
          enum:
          - 'true'
          - 'false'
          example: true
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionExceptionList:
                  value:
                    _version: WzExNDY1LDFd
                    created_at: '2025-01-09T16:19:50.280Z'
                    created_by: elastic
                    description: This is a sample detection type exception
                    id: b2f4a715-6ab1-444c-8b1e-3fa1b1049429
                    immutable: false
                    list_id: d6390d60-bce3-4a48-9002-52db600f329c
                    name: Sample Detection Exception List [Duplicate]
                    namespace_type: single
                    os_types: []
                    tags:
                    - malware
                    tie_breaker_id: 6fa670bd-666d-4c9c-9f1e-d1dbc516e985
                    type: detection
                    updated_at: '2025-01-09T16:19:50.280Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type: Invalid enum value. Expected ''agnostic'' | ''single'', received ''foo'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_duplicate] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Exception list not found
        '405':
          content:
            application/json:
              examples:
                notAllowed:
                  value:
                    message: 'Cannot duplicate: list is immutable or the operation is not allowed in this state'
                    status_code: 405
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list to duplicate not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Duplicate an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/_export:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_export</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Export an exception list and its associated items to an NDJSON file.'
      operationId: ExportExceptionList
      parameters:
      - description: Exception list's internal `id` (UUID) returned on create; use with `list_id` and `namespace_type` for an unambiguous target.
        in: query
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
      - description: Human-readable `list_id` of the exception list to export, as shown in the UI and API responses.
        in: query
        name: list_id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      - description: '`single` exports a list in the current Kibana space; `agnostic` exports a global (space-agnostic) list.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: true
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
      - description: Determines whether to include expired exceptions in the exported list. Expiration date defined by `expire_time`.
        example: true
        in: query
        name: include_expired_exceptions
        required: true
        schema:
          default: 'true'
          enum:
          - 'true'
          - 'false'
          type: string
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                exportSavedObjectsResponse:
                  value: '{"_version":"WzExNDU5LDFd","created_at":"2025-01-09T16:18:17.757Z","created_by":"elastic","description":"This is a sample detection type exception","id":"c86c2da0-2ab6-4343-b81c-216ef27e8d75","immutable":false,"list_id":"simple_list","name":"Sample Detection Exception List","namespace_type":"single","os_types":[],"tags":["user added string for a tag","malware"],"tie_breaker_id":"cf4a7b92-732d-47f0-a0d5-49a35a1736bf","type":"detection","updated_at":"2025-01-09T16:18:17.757Z","updated_by":"elastic","version":1}

                    {"_version":"WzExNDYxLDFd","comments":[],"created_at":"2025-01-09T16:18:42.308Z","created_by":"elastic","description":"This is a sample endpoint type exception","entries":[{"type":"exists","field":"actingProcess.file.signer","operator":"excluded"},{"type":"match_any","field":"host.name","value":["some host","another host"],"operator":"included"}],"id":"f37597ce-eaa7-4b64-9100-4301118f6806","item_id":"simple_list_item","list_id":"simple_list","name":"Sample Endpoint Exception List","namespace_type":"single","os_types":["linux"],"tags":["user added string for a tag","malware"],"tie_breaker_id":"4ca3ef3e-9721-42c0-8107-cf47e094d40f","type":"simple","updated_at":"2025-01-09T16:18:42.308Z","updated_by":"elastic"}

                    {"exported_exception_list_count":1,"exported_exception_list_item_count":1,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}

                    '
              schema:
                description: A `.ndjson` file containing specified exception list and its items
                format: binary
                type: string
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: list_id: Required, namespace_type: Required'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_export] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Export an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all exception list containers.'
      operationId: FindExceptionLists
      parameters:
      - description: 'Filters the returned results according to the value of the specified field.


          Uses the `so type.field name:field` value syntax, where `so type` can be:


          - `exception-list`: Specify a space-aware exception list.

          - `exception-list-agnostic`: Specify an exception list that is shared across spaces.

          '
        in: query
        name: filter
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_FindExceptionListsFilter'
      - description: 'Determines whether the returned containers are Kibana associated with a Kibana space

          or available in all spaces (`agnostic` or `single`)

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          default:
          - single
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          type: array
      - description: The page number to return
        in: query
        name: page
        required: false
        schema:
          example: 1
          minimum: 1
          type: integer
      - description: The number of exception lists to return per page
        in: query
        name: per_page
        required: false
        schema:
          example: 20
          minimum: 1
          type: integer
      - description: Determines which field is used to sort the results.
        in: query
        name: sort_field
        required: false
        schema:
          example: name
          type: string
      - description: Determines the sort order, which can be `desc` or `asc`.
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - desc
          - asc
          example: desc
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleLists:
                  value:
                    data:
                    - _version: WzIsMV0=
                      created_at: '2025-01-07T19:34:27.942Z'
                      created_by: elastic
                      description: This is a sample detection type exception list.
                      id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                      immutable: false
                      list_id: simple_list
                      name: Detection Exception List
                      namespace_type: single
                      os_types: []
                      tags:
                      - malware
                      tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                      type: detection
                      updated_at: '2025-01-07T19:34:27.942Z'
                      updated_by: elastic
                      version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
                    type: array
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                - data
                - page
                - per_page
                - total
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/_find?namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception lists
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/_import:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_import</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Import an exception list and its associated items from an NDJSON file.'
      operationId: ImportExceptionList
      parameters:
      - description: 'Determines whether existing exception lists with the same `list_id` are overwritten.

          If any exception items have the same `item_id`, those are also overwritten.

          '
        in: query
        name: overwrite
        required: false
        schema:
          default: false
          example: false
          type: boolean
      - description: 'Determines whether the list being imported will have a new `list_id` generated.

          Additional `item_id`''s are generated for each exception item. Both the exception

          list and its items are overwritten.

          '
        in: query
        name: as_new_list
        required: false
        schema:
          default: false
          example: false
          type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              ndjsonUpload:
                value:
                  file: exception_lists.ndjson
            schema:
              type: object
              properties:
                file:
                  description: A `.ndjson` file containing the exception list
                  example: '{"_version":"WzExNDU5LDFd","created_at":"2025-01-09T16:18:17.757Z","created_by":"elastic","description":"This is a sample detection type exception","id":"c86c2da0-2ab6-4343-b81c-216ef27e8d75","immutable":false,"list_id":"simple_list","name":"Sample Detection Exception List","namespace_type":"single","os_types":[],"tags":["user added string for a tag","malware"],"tie_breaker_id":"cf4a7b92-732d-47f0-a0d5-49a35a1736bf","type":"detection","updated_at":"2025-01-09T16:18:17.757Z","updated_by":"elastic","version":1}

                    {"_version":"WzExNDYxLDFd","comments":[],"created_at":"2025-01-09T16:18:42.308Z","created_by":"elastic","description":"This is a sample endpoint type exception","entries":[{"type":"exists","field":"actingProcess.file.signer","operator":"excluded"},{"type":"match_any","field":"host.name","value":["some host","another host"],"operator":"included"}],"id":"f37597ce-eaa7-4b64-9100-4301118f6806","item_id":"simple_list_item","list_id":"simple_list","name":"Sample Endpoint Exception List","namespace_type":"single","os_types":["linux"],"tags":["user added string for a tag","malware"],"tie_breaker_id":"4ca3ef3e-9721-42c0-8107-cf47e094d40f","type":"simple","updated_at":"2025-01-09T16:18:42.308Z","updated_by":"elastic"}

                    '
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                withErrors:
                  value:
                    errors:
                    - error:
                        message: 'Error found importing exception list: Invalid value \"4\" supplied to \"list_id\"'
                        status_code: 400
                      list_id: (unknown list_id)
                    - error:
                        message: 'Found that item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" already exists. Import of item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" skipped.'
                        status_code: 409
                      item_id: f7fd00bb-dba8-4c93-9d59-6cbd427b6330
                      list_id: 7d7cccb8-db72-4667-b1f3-648efad7c1ee
                    success: false,
                    success_count: 0,
                    success_count_exception_list_items: 0
                    success_count_exception_lists: 0,
                    success_exception_list_items: false,
                    success_exception_lists: false,
                withoutErrors:
                  value:
                    errors: []
                    success: true
                    success_count: 2
                    success_count_exception_list_items: 1
                    success_count_exception_lists: 1
                    success_exception_list_items: true
                    success_exception_lists: true,
              schema:
                type: object
                properties:
                  errors:
                    $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkErrorArray'
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                  success_count_exception_list_items:
                    minimum: 0
                    type: integer
                  success_count_exception_lists:
                    minimum: 0
                    type: integer
                  success_exception_list_items:
                    type: boolean
                  success_exception_lists:
                    type: boolean
                required:
                - errors
                - success
                - success_count
                - success_exception_lists
                - success_count_exception_lists
                - success_exception_list_items
                - success_count_exception_list_items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: Multipart part `file` is required and must contain a valid .ndjson exception list export
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_import] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Import an exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/items:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete an exception list item using the `id` or `item_id` field.'
      operationId: DeleteExceptionListItem
      parameters:
      - description: Exception item's identifier. Either `id` or `item_id` must be specified
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
      - description: Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified
        in: query
        name: item_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
      - description: '`single` deletes the item in the current Kibana space; `agnostic` deletes an item in a space-agnostic list. Must match the list that owns the item.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleExceptionItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    - field: host.name
                      operator: included
                      type: match_any
                      value:
                      - saturn
                      - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/exception_lists/items?item_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an exception list item
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of an exception list item using the `id` or `item_id` field.'
      operationId: ReadExceptionListItem
      parameters:
      - description: Exception list item's identifier. Either `id` or `item_id` must be specified.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
      - description: Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified.
        in: query
        name: item_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
      - description: '`single` fetches the item in the current space; `agnostic` fetches a global (space-agnostic) item. Must

          match how the list was created.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    - field: host.name
                      operator: included
                      type: match_any
                      value:
                      - saturn
                      - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/items?item_id=&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get an exception list item
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an exception item and associate it with the specified exception list.

        > info

        > Before creating exception items, you must create an exception list.

        '
      operationId: CreateExceptionListItem
      requestBody:
        content:
          application/json:
            examples:
              simpleItem:
                value:
                  description: This is a sample detection type exception item.
                  entries:
                  - field: actingProcess.file.signer
                    operator: excluded
                    type: exists
                  item_id: simple_list_item
                  list_id: simple_list
                  name: Sample Exception List Item
                  namespace_type: single
                  os_types:
                  - linux
                  tags:
                  - malware
                  type: simple
            schema:
              oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemGeneric'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEndpointList'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEventFilters'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemHostIsolation'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistLinux'
              - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistMac'
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                autogeneratedItemId:
                  value:
                    _version: WzYsMV0=
                    comments: []
                    created_at: '2025-01-09T01:16:23.322Z'
                    created_by: elastic
                    description: This is a sample exception that has no item_id so it is autogenerated.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    id: 323faa75-c657-4fa0-9084-8827612c207b
                    item_id: 80e6edf7-4b13-4414-858f-2fa74aa52b37
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Autogenerated Exception List Item ID
                    namespace_type: single
                    os_types: []
                    tags:
                    - malware
                    tie_breaker_id: d6799986-3a23-4213-bc6d-ed9463a32f23
                    type: simple
                    updated_at: '2025-01-09T01:16:23.322Z'
                    updated_by: elastic
                detectionExceptionListItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withExistEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchAnyEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: host.name
                      operator: included
                      type: match_any
                      value:
                      - saturn
                      - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - field: actingProcess.file.signer
                      operator: included
                      type: match
                      value: Elastic N.V.
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withNestedEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                    - entries:
                      - field: signer
                        operator: included
                        type: match
                        value: Evil
                      - field: trusted
                        operator: included
                        type: match
                        value: true
                      field: file.signature
                      type: nested
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withValueListEntry:
                  value:
                    _version: WzcsMV0=
                    comments: []
                    created_at: '2025-01-09T01:31:12.614Z'
                    created_by: elastic
                    description: Don't signal when agent.name is rock01 and source.ip is in the goodguys.txt list
                    entries:
                    - field: source.ip
                      list:
                        id: goodguys.txt
                        type: ip
                      operator: excluded
                      type: list
                    id: deb26876-297d-4677-8a1f-35467d2f1c4f
                    item_id: 686b129e-9b8d-4c59-8d8d-c93a9ea82c71
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Filter out good guys ip and agent.name rock01
                    namespace_type: single
                    os_types: []
                    tags:
                    - malware
                    tie_breaker_id: 5e0288ce-6657-4c18-9dcc-00ec9e8cc6c8
                    type: simple
                    updated_at: '2025-01-09T01:31:12.614Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request,
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400,
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list item id: \"simple_list_item\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an exception list item
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update an exception list item using the `id` or `item_id` field.'
      operationId: UpdateExceptionListItem
      requestBody:
        content:
          application/json:
            examples:
              updateItem:
                value:
                  description: Updated description
                  id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                  name: Updated name
                  namespace_type: single
                  type: simple
            schema:
              oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemGeneric'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEndpointList'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEventFilters'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemHostIsolation'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux'
              - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistMac'
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItem:
                  value:
                    _version: WzEyLDFd
                    comments: []
                    created_at: '2025-01-07T21:12:25.512Z'
                    created_by: elastic
                    description: Updated description
                    entries:
                    - field: host.name
                      operator: included
                      type: match
                      value: rock01
                    id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Updated name
                    namespace_type: single
                    os_types: []
                    tags: []
                    tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                    type: simple
                    updated_at: '2025-01-07T21:34:50.233Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: item_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update an exception list item
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/items/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all exception list items in the specified list.'
      operationId: FindExceptionListItems
      parameters:
      - description: The `list_id`s of the items to fetch.
        in: query
        name: list_id
        required: true
        schema:
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
          type: array
      - description: 'Filters the returned results according to the value of the specified field,

          using the `<field name>:<field value>` syntax.

          '
        examples:
          singleFilter:
            value:
            - exception-list.attributes.name:%My%20item
        in: query
        name: filter
        required: false
        schema:
          default: []
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
          type: array
      - description: 'Determines whether the returned containers are Kibana associated with a Kibana space

          or available in all spaces (`agnostic` or `single`)

          '
        examples:
          single:
            value:
            - single
        in: query
        name: namespace_type
        required: false
        schema:
          default:
          - single
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          type: array
      - description: 'Free-text search term applied to exception list item fields (for example a hostname or file path fragment).

          '
        in: query
        name: search
        required: false
        schema:
          example: host.name
          type: string
      - description: The page number to return
        in: query
        name: page
        required: false
        schema:
          example: 1
          minimum: 0
          type: integer
      - description: The number of exception list items to return per page
        in: query
        name: per_page
        required: false
        schema:
          example: 20
          minimum: 0
          type: integer
      - description: Determines which field is used to sort the results.
        example: name
        in: query
        name: sort_field
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      - description: Determines the sort order, which can be `desc` or `asc`.
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - desc
          - asc
          example: desc
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItems:
                  value:
                    data:
                    - _version: WzgsMV0=
                      comments: []
                      created_at: '2025-01-07T21:12:25.512Z'
                      created_by: elastic
                      description: This is a sample exception item.
                      entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                        - jupiter
                        - saturn
                      id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                      item_id: simple_list_item
                      list_id: simple_list
                      name: Sample Exception List Item
                      namespace_type: single
                      os_types:
                      - linux
                      tags:
                      - malware
                      tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                      type: simple
                      updated_at: '2025-01-07T21:12:25.512Z'
                      updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
                    type: array
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  pit:
                    type: string
                  total:
                    minimum: 0
                    type: integer
                required:
                - data
                - page
                - per_page
                - total
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/items/_find?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception list items
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exception_lists/summary:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/summary</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a summary of the specified exception list.'
      operationId: ReadExceptionListSummary
      parameters:
      - description: Exception list's identifier generated upon creation.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
      - description: Exception list's human readable identifier.
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      - description: '`single` returns summary for a list in the current space; `agnostic` for a space-agnostic list. Must

          line up with `id` / `list_id` used to look up the list.

          '
        examples:
          agnostic:
            value: agnostic
          single:
            value: single
        in: query
        name: namespace_type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
      - description: Search filter clause
        in: query
        name: filter
        required: false
        schema:
          example: exception-list-agnostic.attributes.tags:"policy:policy-1" OR exception-list-agnostic.attributes.tags:"policy:all"
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                summary:
                  value:
                    linux: 0
                    macos: 0
                    total: 0
                    windows: 0
              schema:
                type: object
                properties:
                  linux:
                    minimum: 0
                    type: integer
                  macos:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                  windows:
                    minimum: 0
                    type: integer
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/summary?list_id=simple_list&namespace_type=agnostic] is unauthorized for user, this action is granted by the Kibana privileges [lists-summary]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get an exception list summary
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/exceptions/shared:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exceptions/shared</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.

        > info

        > All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.

        '
      operationId: CreateSharedExceptionList
      requestBody:
        content:
          application/json:
            examples:
              createSharedExceptionList:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                  - linux
                  tags:
                  - malware
            schema:
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
              required:
              - name
              - description
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                sharedList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                    - linux
                    tags:
                    - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a shared exception list
      tags:
      - Security Exceptions API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Exceptions_API_UpdateExceptionListItemEventFilters:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_EventFiltersProperties'
    Security_Exceptions_API_ExceptionListItemEntryMatchAny:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
          - match_any
          type: string
        value:
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
          minItems: 1
          type: array
      required:
      - type
      - field
      - value
      - operator
    Security_Exceptions_API_ExceptionListTags:
      description: String array containing words and phrases to help categorize exception containers.
      items:
        type: string
      type: array
    Security_Exceptions_API_TrustedDevicesWindowsMacProperties:
      description: Trusted devices list item properties (Windows + macOS, username not supported).
      type: object
      properties:
        entries:
          description: Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS)
          items:
            type: object
            properties:
              field:
                description: Device field to match against (username not available for multi-OS)
                enum:
                - device.serial_number
                - device.type
                - host.name
                - device.vendor.name
                - device.vendor.id
                - device.product.id
                - device.product.name
                type: string
              operator:
                description: Must be the value "included"
                enum:
                - included
                type: string
              type:
                description: Entry match type
                enum:
                - match
                - wildcard
                - match_any
                type: string
              value:
                oneOf:
                - description: Single value (used with match or wildcard)
                  type: string
                - description: Array of values (used with match_any)
                  items:
                    type: string
                  minItems: 1
                  type: array
            required:
            - field
            - type
            - value
            - operator
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_devices
          example: endpoint_trusted_devices
          type: string
        os_types:
          description: Must include both Windows and macOS (username field not allowed)
          items:
            enum:
            - windows
            - macos
            type: string
          maxItems: 2
          minItems: 2
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties'
    Security_Exceptions_API_PlatformErrorResponse:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
      required:
      - statusCode
      - error
      - message
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties'
    Security_Exceptions_API_CreateRuleExceptionListItemProps:
      type: object
      properties:
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemCommentArray'
          default: []
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        expire_time:
          format: date-time
          type: string
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
          default: []
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
          default: []
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
      required:
      - type
      - name
      - description
      - entries
    Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry:
      type: object
      properties:
        entries:
          description: Nested subject_name entries
          items:
            type: object
            properties:
              field:
                description: Certificate subject name
                enum:
                - subject_name
                type: string
              operator:
                description: Must be the value "included"
                enum:
                - included
                type: string
              type:
                description: Match type for subject name
                enum:
                - match
                - match_any
                type: string
              value:
                oneOf:
                - description: Single subject name (used with match)
                  type: string
                - description: Array of subject names (used with match_any)
                  items:
                    type: string
                  minItems: 1
                  type: array
            required:
            - field
            - type
            - value
            - operator
          minItems: 1
          type: array
        field:
          description: Windows code signature field
          enum:
          - file.Ext.code_signature
          type: string
        type:
          description: Must be nested for Windows code signature
          enum:
          - nested
          type: string
      required:
      - field
      - type
      - entries
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties'
    Security_Exceptions_API_UpdateExceptionListItemCommentArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemComment'
      type: array
    Security_Exceptions_API_UUID:
      description: A universally unique identifier
      format: uuid
      type: string
    Security_Exceptions_API_ExceptionNamespaceType:
      description: 'Determines whether the exception container is available in all Kibana spaces or just the space

        in which it is created, where:


        - `single`: Only available in the Kibana space in which it is created.

        - `agnostic`: Available in all Kibana spaces.


        For endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

        '
      enum:
      - agnostic
      - single
      type: string
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties'
    Security_Exceptions_API_ExceptionListItemEntryOperator:
      enum:
      - excluded
      - included
      type: string
    Security_Exceptions_API_UpdateExceptionListItemGeneric:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - example:
          comments: []
          description: Updated description
          entries:
          - field: host.name
            operator: included
            type: match
            value: rock01
          item_id: simple_list_item
          name: Updated name
          namespace_type: single
          tags: []
          type: simple
        type: object
        properties:
          entries:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
          list_id:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
          os_types:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
            default: []
          tags:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
        required:
        - entries
    Security_Exceptions_API_ExceptionListItemHumanId:
      description: Human readable string identifier, e.g. `trusted-linux-processes`
      example: simple_list_item
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_UpdateExceptionListItemBase:
      type: object
      properties:
        _version:
          description: The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.
          type: string
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemCommentArray'
          default: []
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
          description: Either `id` or `item_id` must be specified
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
          description: Either `id` or `item_id` must be specified
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
      required:
      - type
      - name
      - description
    Security_Exceptions_API_CreateRuleExceptionListItemCommentArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemComment'
      type: array
    Security_Exceptions_API_ExceptionListItemId:
      description: Exception's identifier.
      example: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_BlocklistWindowsProperties:
      description: Blocklist list item properties (Windows, supports code signature).
      type: object
      properties:
        entries:
          description: '**Validation rules:**

            * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)

            * Path entry: only 1 allowed

            * Code signature entry: only 1 allowed

            '
          items:
            oneOf:
            - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_blocklists
          example: endpoint_blocklists
          type: string
        os_types:
          description: Windows-only
          items:
            enum:
            - windows
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties'
    Security_Exceptions_API_UpdateExceptionListItemHostIsolation:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_HostIsolationProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties'
    Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties'
    Security_Exceptions_API_ExceptionListItemEntryMatch:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
          - match
          type: string
        value:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - type
      - field
      - value
      - operator
    Security_Exceptions_API_HostIsolationProperties:
      description: Host isolation exceptions list item properties.
      type: object
      properties:
        entries:
          description: Exactly one entry allowed for host isolation exceptions
          items:
            type: object
            properties:
              field:
                description: Must be destination.ip
                enum:
                - destination.ip
                type: string
              operator:
                description: Must be the value "included"
                enum:
                - included
                type: string
              type:
                description: Must be match
                enum:
                - match
                type: string
              value:
                description: Valid IPv4 address or CIDR notation (e.g., "192.168.1.1" or "10.0.0.0/8")
                type: string
            required:
            - field
            - type
            - value
            - operator
          maxItems: 1
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_host_isolation_exceptions
          example: endpoint_host_isolation_exceptions
          type: string
        os_types:
          description: Must include all three operating systems (windows, linux, macos)
          items:
            enum:
            - windows
            - linux
            - macos
            type: string
          maxItems: 3
          minItems: 3
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_ExceptionListItemEntryArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntry'
      type: array
    Security_Exceptions_API_ExceptionListOsTypeArray:
      description: Use this field to specify the operating system. Only enter one value.
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
      type: array
    Security_Exceptions_API_NonEmptyString:
      description: A string that does not contain only whitespace characters
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem:
      oneOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
    Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties'
    Security_Exceptions_API_BlocklistHashOrPathEntry:
      type: object
      properties:
        field:
          description: File hash or path field
          enum:
          - file.hash.md5
          - file.hash.sha1
          - file.hash.sha256
          - file.path
          - file.path.caseless
          type: string
        operator:
          description: Must be the value "included"
          enum:
          - included
          type: string
        type:
          description: Must be match_any for blocklists
          enum:
          - match_any
          type: string
        value:
          description: Array of hash values or file paths
          items:
            type: string
          minItems: 1
          type: array
      required:
      - field
      - type
      - value
      - operator
    Security_Exceptions_API_SiemErrorResponse:
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
      required:
      - status_code
      - message
    Security_Exceptions_API_ExceptionListItemEntryMatchWildcard:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
          - wildcard
          type: string
        value:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - type
      - field
      - value
      - operator
    Security_Exceptions_API_ExceptionListOsType:
      description: Use this field to specify the operating system.
      enum:
      - linux
      - macos
      - windows
      type: string
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties'
    Security_Exceptions_API_ExceptionListItemMeta:
      additionalProperties: true
      type: object
    Security_Exceptions_API_CreateExceptionListItemCommentArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemComment'
      type: array
    Security_Exceptions_API_ListType:
      description: 'Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:


        - `keyword`: Many ECS fields are Elasticsearch keywords

        - `ip`: IP addresses

        - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)

        '
      enum:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      type: string
    Security_Exceptions_API_TrustedDevicesWindowsProperties:
      description: Trusted devices list item properties (Windows-only, allows username field).
      type: object
      properties:
        entries:
          description: Exception entries for the trusted device (duplicate field entries are not allowed)
          items:
            type: object
            properties:
              field:
                description: Device field to match against (user.name is Windows-only)
                enum:
                - device.serial_number
                - device.type
                - host.name
                - device.vendor.name
                - device.vendor.id
                - device.product.id
                - device.product.name
                - user.name
                type: string
              operator:
                description: Must be the value "included"
                enum:
                - included
                type: string
              type:
                description: Entry match type
                enum:
                - match
                - wildcard
                - match_any
                type: string
              value:
                oneOf:
                - description: Single value (used with match or wildcard)
                  type: string
                - description: Array of values (used with match_any)
                  items:
                    type: string
                  minItems: 1
                  type: array
            required:
            - field
            - type
            - value
            - operator
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_devices
          example: endpoint_trusted_devices
          type: string
        os_types:
          description: Must be Windows-only to allow username field
          items:
            enum:
            - windows
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_EventFiltersProperties:
      description: Event filters list item properties.
      type: object
      properties:
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
          description: 'Exception entries for the event filter.


            **Flexible field support:** Any event field name is allowed (e.g., `process.name`, `file.path`, `event.action`, `dns.question.name`, etc.)


            **Minimum requirement:** At least 1 entry required

            '
        list_id:
          enum:
          - endpoint_event_filters
          example: endpoint_event_filters
          type: string
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
          default: []
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_EndpointListProperties:
      description: Elastic Endpoint exception list item properties.
      type: object
      properties:
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
          description: 'Exception entries for endpoint security exceptions (used to prevent detection rule alerts).


            **Fully flexible:** Supports any field name for maximum compatibility with detection rules. No field restrictions are enforced.

            '
        list_id:
          enum:
          - endpoint_list
          example: endpoint_list
          type: string
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
          default: []
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_ExceptionListVersion:
      description: The document version, automatically increasd on updates.
      minimum: 1
      type: integer
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties'
    Security_Exceptions_API_ExceptionListDescription:
      description: Describes the exception list.
      example: This list tracks allowlisted values.
      type: string
    Security_Exceptions_API_ExceptionListItemExpireTime:
      description: The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.
      format: date-time
      type: string
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties'
    Security_Exceptions_API_ExceptionListName:
      description: The name of the exception list.
      example: My exception list
      type: string
    Security_Exceptions_API_ExceptionListItemCommentArray:
      description: 'Array of comment fields:


        - comment (string): Comments about the exception item.

        '
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemComment'
      type: array
    Security_Exceptions_API_TrustedAppsWindowsProperties:
      description: Trusted applications list item properties (Windows).
      type: object
      properties:
        entries:
          description: Process hash, executable path, or code signature entries
          items:
            oneOf:
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_apps
          example: endpoint_trusted_apps
          type: string
        os_types:
          description: Must be Windows only
          items:
            enum:
            - windows
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_CreateExceptionListItemBlocklistMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistMacProperties'
    Security_Exceptions_API_FindExceptionListsFilter:
      example: exception-list.attributes.name:%Detection%20List
      type: string
    Security_Exceptions_API_TrustedAppPathEntry:
      type: object
      properties:
        field:
          description: Process executable path field
          enum:
          - process.executable.caseless
          type: string
        operator:
          enum:
          - included
          type: string
        type:
          description: Path supports both match and wildcard types
          enum:
          - match
          - wildcard
          type: string
        value:
          description: Executable path
          type: string
      required:
      - field
      - type
      - value
      - operator
    Security_Exceptions_API_CreateExceptionListItemHostIsolation:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_HostIsolationProperties'
    Security_Exceptions_API_UpdateExceptionListItemComment:
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - comment
    Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry:
      type: object
      properties:
        entries:
          description: Must include exactly 2 entries - one for subject_name and one for trusted
          items:
            oneOf:
            - type: object
              properties:
                field:
                  enum:
                  - subject_name
                  type: string
                operator:
                  enum:
                  - included
                  type: string
                type:
                  enum:
                  - match
                  type: string
                value:
                  description: Certificate subject name
                  type: string
              required:
              - field
              - type
              - value
              - operator
            - type: object
              properties:
                field:
                  enum:
                  - trusted
                  type: string
                operator:
                  enum:
                  - included
                  type: string
                type:
                  enum:
                  - match
                  type: string
                value:
                  description: Must be the string 'true'
                  enum:
                  - 'true'
                  type: string
              required:
              - field
              - type
              - value
              - operator
          maxItems: 2
          minItems: 2
          type: array
        field:
          description: Windows code signature field
          enum:
          - process.Ext.code_signature
          type: string
        type:
          enum:
          - nested
          type: string
      required:
      - field
      - type
      - entries
    Security_Exceptions_API_ExceptionListItemComment:
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        created_at:
          description: Autogenerated date of object creation.
          format: date-time
          type: string
        created_by:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        updated_at:
          description: Autogenerated date of last object update.
          format: date-time
          type: string
        updated_by:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - id
      - comment
      - created_at
      - created_by
    Security_Exceptions_API_CreateRuleExceptionListItemComment:
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - comment
    Security_Exceptions_API_ExceptionListItemType:
      enum:
      - simple
      type: string
    Security_Exceptions_API_ExceptionListItemEntry:
      anyOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryList'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNested'
      - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchWildcard'
      discriminator:
        propertyName: type
    Security_Exceptions_API_ExceptionListItemEntryList:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        list:
          type: object
          properties:
            id:
              $ref: '#/components/schemas/Security_Exceptions_API_ListId'
            type:
              $ref: '#/components/schemas/Security_Exceptions_API_ListType'
          required:
          - id
          - type
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
          - list
          type: string
      required:
      - type
      - field
      - list
      - operator
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties'
    Security_Exceptions_API_ExceptionListsImportBulkError:
      type: object
      properties:
        error:
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
          required:
          - status_code
          - message
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
      required:
      - error
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties'
    Security_Exceptions_API_CreateExceptionListItemEventFilters:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_EventFiltersProperties'
    Security_Exceptions_API_CreateExceptionListItemBase:
      type: object
      properties:
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemCommentArray'
          default: []
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          default: single
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
      required:
      - type
      - name
      - description
    Security_Exceptions_API_TrustedDevicesMacProperties:
      description: Trusted devices list item properties (macOS-only, username not supported).
      type: object
      properties:
        entries:
          description: Exception entries for the trusted device (duplicate field entries are not allowed)
          items:
            type: object
            properties:
              field:
                description: Device field to match against
                enum:
                - device.serial_number
                - device.type
                - host.name
                - device.vendor.name
                - device.vendor.id
                - device.product.id
                - device.product.name
                type: string
              operator:
                description: Must be the value "included"
                enum:
                - included
                type: string
              type:
                description: Entry match type
                enum:
                - match
                - wildcard
                - match_any
                type: string
              value:
                oneOf:
                - description: Single value (used with match or wildcard)
                  type: string
                - description: Array of values (used with match_any)
                  items:
                    type: string
                  minItems: 1
                  type: array
            required:
            - field
            - type
            - value
            - operator
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_devices
          example: endpoint_trusted_devices
          type: string
        os_types:
          description: macOS-only
          items:
            enum:
            - macos
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_ExceptionListsImportBulkErrorArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkError'
      type: array
    Security_Exceptions_API_ExceptionListItemEntryNested:
      type: object
      properties:
        entries:
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem'
          minItems: 1
          type: array
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        type:
          enum:
          - nested
          type: string
      required:
      - type
      - field
      - entries
    Security_Exceptions_API_ExceptionListItemOsTypeArray:
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
      type: array
    Security_Exceptions_API_UpdateExceptionListItemEndpointList:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_EndpointListProperties'
    Security_Exceptions_API_ExceptionListItem:
      type: object
      properties:
        _version:
          description: The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
          type: string
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemCommentArray'
        created_at:
          description: Autogenerated date of object creation.
          format: date-time
          type: string
        created_by:
          description: Autogenerated value - user that created object.
          type: string
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
        tie_breaker_id:
          description: Field used in search to ensure all containers are sorted and returned correctly.
          type: string
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
        updated_at:
          description: Autogenerated date of last object update.
          format: date-time
          type: string
        updated_by:
          description: Autogenerated value - user that last updated object.
          type: string
      required:
      - id
      - item_id
      - list_id
      - type
      - name
      - description
      - entries
      - namespace_type
      - comments
      - tie_breaker_id
      - created_at
      - created_by
      - updated_at
      - updated_by
    Security_Exceptions_API_ExceptionListItemDescription:
      description: Describes the exception list.
      type: string
    Security_Exceptions_API_ExceptionListType:
      description: The type of exception list to be created. Different list types may denote where they can be utilized.
      enum:
      - detection
      - rule_default
      - endpoint
      - endpoint_trusted_apps
      - endpoint_trusted_devices
      - endpoint_events
      - endpoint_host_isolation_exceptions
      - endpoint_blocklists
      type: string
    Security_Exceptions_API_ExceptionListItemTags:
      items:
        description: String array containing words and phrases to help categorize exception items.
        format: nonempty
        minLength: 1
        type: string
      type: array
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties'
    Security_Exceptions_API_ExceptionListHumanId:
      description: 'The exception list''s human-readable string identifier.


        For endpoint artifacts, use one of the following values:


        * `endpoint_list`: [Elastic Endpoint exception list](https://www.elastic.co/docs/solutions/security/detect-and-alert/add-manage-exceptions)

        * `endpoint_trusted_apps`: [Trusted applications list](https://www.elastic.co/docs/solutions/security/manage-elastic-defend/trusted-applications)

        * `endpoint_trusted_devices`: [Trusted devices list](https://www.elastic.co/docs/solutions/security/manage-elastic-defend/trusted-devices)

        * `endpoint_event_filters`: [Event filters list](https://www.elastic.co/docs/solutions/security/manage-elastic-defend/event-filters)

        * `endpoint_host_isolation_exceptions`: [Host isolation exceptions list](https://www.elastic.co/docs/solutions/security/manage-elastic-defend/host-isolation-exceptions)

        * `endpoint_blocklists`: [Blocklists list](https://www.elastic.co/docs/solutions/security/manage-elastic-defend/blocklist)

        '
      example: simple_list
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_ExceptionListItemEntryExists:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
          - exists
          type: string
      required:
      - type
      - field
      - operator
    Security_Exceptions_API_CreateExceptionListItemComment:
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
      required:
      - comment
    Security_Exceptions_API_TrustedAppHashEntry:
      type: object
      properties:
        field:
          description: Process hash field
          enum:
          - process.hash.md5
          - process.hash.sha1
          - process.hash.sha256
          type: string
        operator:
          enum:
          - included
          type: string
        type:
          description: Hash entries only support match type
          enum:
          - match
          type: string
        value:
          description: Hash value (MD5, SHA1, or SHA256)
          type: string
      required:
      - field
      - type
      - value
      - operator
    Security_Exceptions_API_ExceptionListId:
      description: Exception list's identifier.
      example: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_TrustedAppsMacProperties:
      description: Trusted applications list item properties (macOS).
      type: object
      properties:
        entries:
          description: Process hash, executable path, or code signature entries
          items:
            oneOf:
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppMacCodeSignatureEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_apps
          example: endpoint_trusted_apps
          type: string
        os_types:
          description: Must be macOS only
          items:
            enum:
            - macos
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_TrustedAppMacCodeSignatureEntry:
      type: object
      properties:
        entries:
          description: Must include exactly 2 entries - one for subject_name and one for trusted
          items:
            oneOf:
            - type: object
              properties:
                field:
                  enum:
                  - subject_name
                  type: string
                operator:
                  enum:
                  - included
                  type: string
                type:
                  enum:
                  - match
                  type: string
                value:
                  description: Certificate subject name
                  type: string
              required:
              - field
              - type
              - value
              - operator
            - type: object
              properties:
                field:
                  enum:
                  - trusted
                  type: string
                operator:
                  enum:
                  - included
                  type: string
                type:
                  enum:
                  - match
                  type: string
                value:
                  description: Must be the string 'true'
                  enum:
                  - 'true'
                  type: string
              required:
              - field
              - type
              - value
              - operator
          maxItems: 2
          minItems: 2
          type: array
        field:
          description: macOS code signature field
          enum:
          - process.code_signature
          type: string
        type:
          enum:
          - nested
          type: string
      required:
      - field
      - type
      - entries
    Security_Exceptions_API_CreateExceptionListItemEndpointList:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_EndpointListProperties'
    Security_Exceptions_API_CreateExceptionListItemGeneric:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - example:
          description: This is a sample detection type exception item.
          entries:
          - field: actingProcess.file.signer
            operator: excluded
            type: exists
          - field: host.name
            operator: included
            type: match_any
            value:
            - saturn
            - jupiter
          item_id: simple_list_item
          list_id: simple_list
          name: Sample Exception List Item
          namespace_type: single
          os_types:
          - linux
          tags:
          - malware
          type: simple
        type: object
        properties:
          entries:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
          list_id:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
          os_types:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
            default: []
          tags:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
            default: []
        required:
        - list_id
        - entries
    Security_Exceptions_API_ExceptionList:
      type: object
      properties:
        _version:
          description: The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
          type: string
        created_at:
          description: Autogenerated date of object creation.
          format: date-time
          type: string
        created_by:
          description: Autogenerated value - user that created object.
          type: string
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        immutable:
          type: boolean
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
        tie_breaker_id:
          description: Field used in search to ensure all containers are sorted and returned correctly.
          type: string
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
        updated_at:
          description: Autogenerated date of last object update.
          format: date-time
          type: string
        updated_by:
          description: Autogenerated value - user that last updated object.
          type: string
        version:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
      required:
      - id
      - list_id
      - type
      - name
      - description
      - immutable
      - namespace_type
      - version
      - tie_breaker_id
      - created_at
      - created_by
      - updated_at
      - updated_by
    Security_Exceptions_API_TrustedAppsLinuxProperties:
      description: Trusted applications list item properties (Linux).
      type: object
      properties:
        entries:
          description: Process hash or executable path entries (code signature not supported on Linux)
          items:
            oneOf:
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
            - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_trusted_apps
          example: endpoint_trusted_apps
          type: string
        os_types:
          description: Must be Linux only
          items:
            enum:
            - linux
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_ListId:
      description: Value list's identifier.
      example: 21b01cfb-058d-44b9-838c-282be16c91cd
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_BlocklistLinuxProperties:
      description: Blocklist list item properties (Linux, code signature not supported).
      type: object
      properties:
        entries:
          description: '**Validation rules:**

            * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)

            * Path entry: only 1 allowed

            '
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_blocklists
          example: endpoint_blocklists
          type: string
        os_types:
          description: Linux-only
          items:
            enum:
            - linux
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
    Security_Exceptions_API_EndpointArtifactTags:
      default: []
      description: 'Tags for categorization. Special tags for scope control:

        * `"policy:all"` - Global artifact (applies to all Elastic Defend policies)

        * `"policy:<policy_id>"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)

        '
      items:
        type: string
      type: array
    Security_Exceptions_API_UpdateExceptionListItemBlocklistMac:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistMacProperties'
    Security_Exceptions_API_CreateExceptionListItemBlocklistLinux:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties'
    Security_Exceptions_API_CreateExceptionListItemBlocklistWindows:
      allOf:
      - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
      - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties'
    Security_Exceptions_API_ExceptionListMeta:
      additionalProperties: true
      description: Placeholder for metadata about the list container.
      type: object
    Security_Exceptions_API_ExceptionListItemName:
      description: Exception list name.
      format: nonempty
      minLength: 1
      type: string
    Security_Exceptions_API_BlocklistMacProperties:
      description: Blocklist list item properties (macOS, code signature not supported).
      type: object
      properties:
        entries:
          description: '**Validation rules:**

            * Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)

            * Path entry: only 1 allowed

            '
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
          minItems: 1
          type: array
        list_id:
          enum:
          - endpoint_blocklists
          example: endpoint_blocklists
          type: string
        os_types:
          description: macOS-only
          items:
            enum:
            - macos
            type: string
          maxItems: 1
          minItems: 1
          type: array
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      required:
      - list_id
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"