---
title: "POST /audit/suppressions/create"
method: POST
path: "/audit/suppressions/create"
---

# POST /audit/suppressions/create

`POST /audit/suppressions/create`

Creates a Device Defender audit suppression.

Requires permission to access the [CreateAuditSuppression](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions) action.

## Request body

- object
  - `checkName` string, required — An audit check name. Checks must be enabled for your account. (Use <code>DescribeAccountAuditConfiguration</code> to see the list of all checks, including those that are enabled or use <code>UpdateAccountAuditConfiguration</code> to select which checks are enabled.)
  - `resourceIdentifier` object, required — Information that identifies the noncompliant resource.
    - `deviceCertificateId` string — The ID of the certificate attached to the resource.
    - `caCertificateId` string — The ID of the CA certificate used to authorize the certificate.
    - `cognitoIdentityPoolId` string — The ID of the Amazon Cognito identity pool.
    - `clientId` string — The client ID.
    - `policyVersionIdentifier` object — The version of the policy associated with the resource.
      - `policyName` string — The name of the policy.
      - `policyVersionId` string — The ID of the version of the policy associated with the resource.
    - `account` string — The account with which the resource is associated.
    - `iamRoleArn` string — The ARN of the IAM role that has overly permissive actions.
    - `roleAliasArn` string — The ARN of the role alias that has overly permissive actions.
    - `issuerCertificateIdentifier` object — The issuer certificate identifier.
      - `issuerCertificateSubject` string — The subject of the issuer certificate.
      - `issuerId` string — The issuer ID.
      - `issuerCertificateSerialNumber` string — The issuer certificate serial number.
    - `deviceCertificateArn` string — The ARN of the identified device certificate.
  - `expirationDate` string, date-time — The epoch timestamp in seconds at which this suppression expires.
  - `suppressIndefinitely` boolean — Indicates whether a suppression should exist indefinitely or not.
  - `description` string — The description of the audit suppression.
  - `clientRequestToken` string, required — Each audit supression must have a unique client request token. If you try to create a new audit suppression with the same token as one that already exists, an exception occurs. If you omit this value, Amazon Web Services SDKs will automatically generate a unique client request.

## Response `200`

Success

- CreateAuditSuppressionResponse

## Other responses

- `480` — InvalidRequestException
- `481` — ResourceAlreadyExistsException
- `482` — ThrottlingException
- `483` — InternalFailureException
- `484` — LimitExceededException

---

[API](https://skmtc.net/aws/apis/iot.md) · [All operations](https://skmtc.net/aws/apis/iot/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iot/versions/deef5c4b09f0/schema)