# Kibana Security Exceptions API API

**Canonical:** https://apis.io/apis/kibana/kibana-security-exceptions-api-api/  
**Provider:** Kibana — https://apis.io/providers/kibana/  
**Base URL:** https://localhost:5601/api  
**Documentation:** https://www.elastic.co/guide/en/kibana/current/api.html

Kibana Security Exceptions API API is one of 60 APIs that [Kibana](https://apis.io/providers/kibana/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Exceptions API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts. Exceptions are made up of: * **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules. * **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert. For detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated. > info > You cannot use lists with endpoint rule exceptions. > info > Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container. ## Exceptions requirements Before you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).

## Machine-readable artifacts (3)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-exceptions-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/guide/en/kibana/current/api.html
- **Authentication** — https://www.elastic.co/guide/en/kibana/current/api-authentication.html

## Other Kibana APIs (12)

- [Kibana Actions API](https://apis.io/apis/kibana/kibana-actions-api/)
- [Kibana agent builder API](https://apis.io/apis/kibana/kibana-agent-builder-api/)
- [Kibana alerting API](https://apis.io/apis/kibana/kibana-alerting-api/)
- [Kibana APM agent configuration API](https://apis.io/apis/kibana/kibana-apm-agent-configuration-api/)
- [Kibana APM agent keys API](https://apis.io/apis/kibana/kibana-apm-agent-keys-api/)
- [Kibana APM annotations API](https://apis.io/apis/kibana/kibana-apm-annotations-api/)
- [Kibana APM server schema API](https://apis.io/apis/kibana/kibana-apm-server-schema-api/)
- [Kibana APM sourcemaps API](https://apis.io/apis/kibana/kibana-apm-sourcemaps-api/)
- [Kibana cases API](https://apis.io/apis/kibana/kibana-cases-api/)
- [Kibana connectors API](https://apis.io/apis/kibana/kibana-connectors-api/)
- [Kibana Data streams API](https://apis.io/apis/kibana/kibana-data-streams-api/)
- [Kibana data views API](https://apis.io/apis/kibana/kibana-data-views-api/)

## Tags

Security Exceptions API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/kibana/kibana-security-exceptions-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/kibana/.