v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB

Security Exceptions API

Duplicate an exception list

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/exception_lists/_duplicate</span></div>

Refer to Spaces for more information.

Duplicate an existing exception list.

post/api/exception_lists/_duplicate

Query parameters

list_idstring nonempty required

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

endpoint_list: Elastic Endpoint exceptions list
endpoint_trusted_apps: Trusted applications list
endpoint_trusted_devices: Trusted devices list
endpoint_event_filters: Event filters list
endpoint_host_isolation_exceptions: Host isolation exceptions list
endpoint_blocklists: Blocklist

Example:simple_list

The list_id of the existing exception list to copy (source list).

namespace_type'agnostic' | 'single' required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

single: Only available in the Kibana space in which it is created.
agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

Scope in which the source list is defined (single = current space, agnostic = all spaces).

include_expired_exceptions'true' | 'false' required

Determines whether to include expired exceptions in the duplicated list. Expiration date defined by expire_time.

Response

Successful response

_versionstring

The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.

created_atstring date-time required

Autogenerated date of object creation.

created_bystring required

Autogenerated value - user that created object.

descriptionstring required

Describes the exception list.

idstring nonempty required

Exception list's identifier.

immutableboolean required

list_idstring nonempty required

The exception list's human-readable string identifier.

For endpoint artifacts, use one of the following values:

endpoint_list: Elastic Endpoint exceptions list
endpoint_trusted_apps: Trusted applications list
endpoint_trusted_devices: Trusted devices list
endpoint_event_filters: Event filters list
endpoint_host_isolation_exceptions: Host isolation exceptions list
endpoint_blocklists: Blocklist

metaSecurityExceptionsAPIExceptionListMeta

Placeholder for metadata about the list container.

namestring required

The name of the exception list.

namespace_type'agnostic' | 'single' required

Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:

single: Only available in the Kibana space in which it is created.
agnostic: Available in all Kibana spaces.

For endpoint artifacts, the namespace_type must always be agnostic. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.

os_typesSecurityExceptionsAPIExceptionListOsType[]

Use this field to specify the operating system. Only enter one value.

tagsstring[]

String array containing words and phrases to help categorize exception containers.

tie_breaker_idstring required

Field used in search to ensure all containers are sorted and returned correctly.

The type of exception list to be created. Different list types may denote where they can be utilized.

updated_atstring date-time required

Autogenerated date of last object update.

updated_bystring required

Autogenerated value - user that last updated object.

versioninteger required

The document version, automatically increasd on updates.

Example response

{
  "description": "This list tracks allowlisted values.",
  "id": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85",
  "list_id": "simple_list",
  "name": "My exception list"
}