---
title: "Exceptions"
method: POST
path: "/api/3/vulnerability_exceptions"
tags: ["Vulnerability Exception"]
---

# Exceptions

`POST /api/3/vulnerability_exceptions`

Creates a vulnerability exception.

## Request body

- VulnerabilityException — The vulnerability exception to create.
  - `expires` string, date-time — The date and time the vulnerability exception is set to expire.
  - `id` object — The identifier of the vulnerability exception.
  - `links` Link[], required — Hypermedia links to corresponding or related resources.
    - `deprecation` string
    - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
    - `hreflang` string
    - `media` string
    - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
    - `title` string
    - `type` string
  - `review` Review — Details regarding the review and/or approval of the exception.
    - `comment` string — A comment from the reviewer detailing the review.
    - `date` string, date-time — The date and time the review took place.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `name` string — The identifier of the user that reviewed the vulnerability exception.
    - `user` object — The identifier of the user.
  - `scope` ExceptionScope — The scope of the vulnerability exception, indicating the results it applies to.
    - `id` integer — The identifier of the scope type to which the exception applies. For example in a site scoped vulnerability exception this is the site id, in an asset group vulnerability exception this is the asset group id.
    - `key` string — If the scope type is `"Instance"`, an optional key to discriminate the instance the exception applies to.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `port` integer — If the scope type is `"Instance"` and the vulnerability is detected on a service, the port on which the exception applies.
    - `type` string — The type of the exception scope. One of: `"Global"`, `"Site"`, `"Asset"`, `"Asset Group"`, `"Instance"`
    - `vulnerability` object — The identifier of the vulnerability.
  - `state` string — The state of the vulnerability exception. One of: `"Deleted"`, `"Expired"`, `"Approved"`, `"Rejected"`, `"Under Review"`.
  - `submit` Submission — Details regarding the submission of the exception.
    - `comment` string — A comment from the submitter as to why the exception was submitted.
    - `date` string, date-time — The date and time the vulnerability exception was submitted.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `name` string — The login name of the user that submitted the vulnerability exception.
    - `reason` string — The reason the vulnerability exception was submitted. One of: `"False Positive"`, `"Compensating Control"`, `"Acceptable Use"`, `"Acceptable Risk"`, `"Other"`
    - `user` object — The identifier of the user.

## Response `200`

OK

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/rapid7/apis/rapid7-vm-api.md) · [All operations](https://skmtc.net/rapid7/apis/rapid7-vm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rapid7/rapid7-vm-api/versions/3a8197c22d71/schema)