--- title: "Search Vulnerability Exceptions" method: POST path: "/api/v2/VulnerabilityExceptions/search" tags: ["VulnerabilityExceptions"] --- # Search Vulnerability Exceptions `POST /api/v2/VulnerabilityExceptions/search` Search vulnerability exceptions by invoking the following endpoint: > `POST https://YourAccount.lacework.net/api/v2/VulnerabilityExceptions/search` To limit the returned result, optionally specify one or more filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW). In the request body, optionally specify the list of fields to return in the response by specifying the list in the `returns` array. Here are some example `body` payloads: * `{ "filters": [ { "field": "exceptionType", "expression": "eq", "value": "Host" } ] }` * `{ "filters": [ { "field": "exceptionType", "expression": "eq", "value": "Container" },` `{ "field": "expiryTime", "expression": "gt", "value": "2021-01-01" } ],` `"returns": [ "name", "exceptionType", "expiryTime" ] }` ## Headers - `Authorization` string, required - `Content-Type` string, required ## Request body - GETDATAREQUESTBODYFILTERS - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match. - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition. - `field` string, required — The name of the data field to which the condition applies. - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value. - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values. - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive. ## Response `200` No Error (List of Vulnerability Exceptions) - object - `data` VulnerabilityExceptionsResponseSchema[] - union - VulnerabilityExceptionsContainerResponseSchema - `exceptionName` string, required — Name of the exception. - `exceptionReason` 'False Positive' | 'Accepted Risk' | 'Compensating Controls' | 'Fix Pending' | 'Other', required — Reason for creating an exception - `resourceScope` object — The set of resources this exception can apply to. The data varies based on the value of the `exceptionType` attribute. - `imageId` string[] — The SHA-256 hash that was generated for the container image. For example, `sha256:ex4ampl3`. - `imageTag` string[] — The container image tag. - `registry` string[] — The container registry. - `repository` string[] — The container repository. - `namespace` string[] — The namespace for the package distribution (for example, an operating system or language package). - `vulnerabilityCriteria` object, required — When sending a request, use this object to define the criteria of the vulnerability to be excluded. The criteria value changes depending on the type of criteria selected. - `cve` string[] — The vulnerability (CVE) ID that you want to constrain the exception to. You can provide multiple IDs. - `package` object[] — The package name (for example, an operating system or language package). This can include a version number. You can provide multiple package names. - `severity` string[] — The severity levels of the vulnerability to constrain the exception to a **Critical**, **High**, **Medium**, **Low**, or **Info** vulnerability. You can provide multiple severity levels. You can provide multiple severity levels. - `fixable` number[] — When sending a request, set to `True` or `False` to constrain the exception to a fixable or non-fixable vulnerability. - `expiryTime` string — The exception's expiration date and time. - `state` 1 — State - `props` object, required — The vulnerability exception's properties. - `description` string — A brief description of the exception creation. - `createdBy` string — The user who creates the exception. - `updatedBy` string — The user who updates the exception. - `exceptionType` 'Container', required — Exception Type - `exceptionGuid` string — Vulnerability Exception ID - `createdTime` string — The time and date when the vulnerability exception was created. - `updatedTime` string — The time and date when the vulnerability exception was last updated. - VulnerabilityExceptionsHostResponseSchema - `exceptionName` string, required — Name of the exception. - `exceptionReason` 'False Positive' | 'Accepted Risk' | 'Compensating Controls' | 'Fix Pending' | 'Other', required — Reason for creating an exception - `resourceScope` object — The set of resources this exception can apply to. The data varies based on the value of the `exceptionType` attribute. - `hostname` string[] — The hostname of the machine. - `externalIp` string[] — The external IP address. - `clusterName` string[] — The cluster name for the group of hosts. - `namespace` string[] — The namespace for the package distribution (for example, an operating system or language package). - `vulnerabilityCriteria` object, required — When sending a request, use this object to define the criteria of the vulnerability to be excluded. The criteria value changes depending on the type of criteria selected. - `cve` string[] — The vulnerability (CVE) ID that you want to constrain the exception to. You can provide multiple IDs. - `package` object[] — The package name (for example, an operating system or language package). This can include a version number. You can provide multiple package names. - `severity` string[] — The severity constrains the vulnerability severity levels for an exception, from **Critical**, **High**, **Medium**, **Low**, or **Info**. You can provide multiple severity levels. - `fixable` number[] — When sending a request, set to `True` or `False` to constrain the exception to a fixable or non-fixable vulnerability. - `expiryTime` string — The exception's expiration date and time. - `state` 1 — State - `props` object, required — The vulnerability exception's properties. - `description` string — A brief description of the exception creation. - `createdBy` string — The user who creates the exception. - `updatedBy` string — The user who updates the exception. - `exceptionType` 'Host', required — Exception Type - `exceptionGuid` string — Vulnerability Exception ID - `createdTime` string — The time and date when the vulnerability exception was created. - `updatedTime` string — The time and date when the vulnerability exception was last updated. ## Other responses - `204` — No Data - `4XX` — Client Error - `5XX` — Internal Server Error --- [API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)