Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Endpoint Exceptions API

Update an Elastic Endpoint rule exception list item

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items</span></div>

Refer to Spaces for more information.

Update an Elastic Endpoint exception list item, specified by the id or item_id field.

put/api/endpoint_list/items

Request body

_versionstring

The version id, normally returned by the API when the item is retrieved. Use it ensure updates are made against the latest version.

descriptionstring required

Describes the exception list.

idstring nonempty

Exception's identifier.

item_idstring nonempty

Human readable string identifier, e.g. trusted-linux-processes

metaSecurityEndpointExceptionsAPIExceptionListItemMeta
namestring nonempty required

Exception list name.

os_typesSecurityEndpointExceptionsAPIExceptionListOsType[]
tagsstring[]
type'simple' required

Example request

{
  "entries": [
    {
      "list": {
        "id": "21b01cfb-058d-44b9-838c-282be16c91cd"
      }
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item"
}

Response

Successful response

_versionstring

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.

created_atstring date-time required

Autogenerated date of object creation.

created_bystring required

Autogenerated value - user that created object.

descriptionstring required

Describes the exception list.

expire_timestring date-time

The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.

idstring nonempty required

Exception's identifier.

item_idstring nonempty required

Human readable string identifier, e.g. trusted-linux-processes

list_idstring nonempty required

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

  • endpoint_list: Elastic Endpoint exceptions list
  • endpoint_trusted_apps: Trusted applications list
  • endpoint_trusted_devices: Trusted devices list
  • endpoint_event_filters: Event filters list
  • endpoint_host_isolation_exceptions: Host isolation exceptions list
  • endpoint_blocklists: Blocklist
metaSecurityEndpointExceptionsAPIExceptionListItemMeta
namestring nonempty required

Exception list name.

namespace_type'agnostic' | 'single' required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

  • single: Only available in the Kibana space in which it is created.
  • agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

os_typesSecurityEndpointExceptionsAPIExceptionListOsType[]
tagsstring[]
tie_breaker_idstring required

Field used in search to ensure all containers are sorted and returned correctly.

type'simple' required
updated_atstring date-time required

Autogenerated date of last object update.

updated_bystring required

Autogenerated value - user that last updated object.

Example response

{
  "entries": [
    {
      "list": {
        "id": "21b01cfb-058d-44b9-838c-282be16c91cd"
      }
    }
  ],
  "id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
  "item_id": "simple_list_item",
  "list_id": "simple_list"
}