Exclusions allow you to prevent trusted applications, websites, and services from being detected by our security engine. This means they won't be scanned or blocked. Use these APIs to manage the exclusions across your account.
openapi: 3.2.0
info:
title: Malwarebytes Exclusions API
version: 1.0.0
description: 'Operations tagged Exclusions across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Exclusions
description: 'Exclusions allow you to prevent trusted applications, websites, and services from being detected by our security engine. This means they won''t be scanned or blocked.
Use these APIs to manage the exclusions across your account.'
paths:
/nebula/v1/exclusions/{id}:
servers:
- url: https://api.threatdown.com
delete:
description: Delete exclusion by id.
summary: Delete exclusion by id
security:
- client_credentials:
- write
- user_permissions:
- exclusions.delete
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: Successful response
tags:
- Exclusions
operationId: api.nebula.delete.exclusions
get:
description: Get exclusion by id.
summary: Get exclusion by id
security:
- client_credentials:
- read
- user_permissions:
- exclusions.view
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: populate_risk
required: false
in: query
description: Populate risk fields on exclusion
schema:
type: boolean
responses:
'200':
description: response schema
content:
application/json:
schema:
title: Exclusion from server
type: object
additionalProperties: true
properties:
id:
type: string
title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- c87998228b2f7511bb1616f686d06bae
type:
type: integer
title: '1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line'
examples:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 13
- 14
- 17
value:
type: string
title: String value
examples:
- '%PROGRAMDATA%'
enabled:
type: boolean
title: Enable
comment:
type: string
title: Comment
created_at:
type: string
title: Created at
updated_at:
type: string
title: Updated at
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
exclude_from:
type: object
title: Exclusion applied to
properties:
exploit_protection:
type:
- boolean
- 'null'
title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
malware_protection:
type:
- boolean
- 'null'
title: Protects against malware infections and zero-day threats
ransomware_protection:
type:
- boolean
- 'null'
title: Detects and blocks ransomware threats using advanced behavior analysis
suspicious_activity:
type:
- boolean
- 'null'
title: Uses advanced machine learning to identify suspicious processes that require additional review
website_protection:
type:
- boolean
- 'null'
title: Blocks network traffic from malicious websites and IP addresses
bruteforce_protection:
type:
- boolean
- 'null'
title: Bruteforce attack protection on RDP, IMAP and so on.
friendly_name:
type: string
title: Friendly name
examples:
- File by MD5 hash
account_level:
type: boolean
title: Account level
policies:
type: array
title: Policies
items:
type: object
title: Policy
properties:
id:
type: string
title: ID of policy (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
additionalProperties: true
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 20da4613-5fa5-4460-9016-963d2c4f6753
name:
type: string
title: Name of policy
tags:
- Exclusions
operationId: api.nebula.get.exclusions.id
put:
description: 'Use this API endpoint to update exclusions.
## Validation rules
- etag is required
- type must be a number from the following list: 1, 2, 3, 4, 5, 6, 7, 8, 13
- exploit_protection can only be true if type is 13
- ransomware_protection can only be true if type is 1 or 2
- malware_protection can only be true if type is 1, 2, 4, or 5
- website_protection can only be true if type is 6, 7, or 8
- bruteforce_protection can only be true if type is 7
- if type is 14, only suspicious_activity can and must be true
- if account_level is false, then policy_ids must be an array of UUID(s)
- value must be a valid domain or website (domain with protocol prefix) if type is 6
- value must be a valid IP address if type is 7
'
summary: Update exclusion
security:
- client_credentials:
- write
- user_permissions:
- exclusions.edit
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Save Exclusion
additionalProperties: true
required:
- etag
- type
- value
- enabled
- exclude_from
- account_level
properties:
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- c87998228b2f7511bb1616f686d06bae
type:
type: integer
title: '1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line, 17: Exclusion for ransomware network protection'
examples:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 13
- 14
- 17
value:
type: string
title: String value
examples:
- '%PROGRAMDATA%'
enabled:
type: boolean
title: Enable
comment:
type: string
title: Comment
exclude_from:
type: object
title: Exclusion applied to
properties:
exploit_protection:
type:
- boolean
- 'null'
title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
malware_protection:
type:
- boolean
- 'null'
title: Protects against malware infections and zero-day threats
ransomware_protection:
type:
- boolean
- 'null'
title: Detects and blocks ransomware threats using advanced behavior analysis
suspicious_activity:
type:
- boolean
- 'null'
title: Uses advanced machine learning to identify suspicious processes that require additional review
website_protection:
type:
- boolean
- 'null'
title: Blocks network traffic from malicious websites and IP addresses
bruteforce_protection:
type:
- boolean
- 'null'
title: Bruteforce attack protection on RDP, IMAP and so on.
friendly_name:
type: string
title: Friendly name
examples:
- File by MD5 hash
account_level:
type: boolean
title: Account level
policy_ids:
type: array
title: IDs of Policies
default: []
items:
type: string
title: ID of the Policy
allOf:
- if:
properties:
type:
const: 13
then:
properties:
value:
pattern: ^[a-fA-F0-9]{32}$
- if:
properties:
enabled:
const: true
then:
errorMessage: should have at least one exclude_from property set to true
anyOf:
- properties:
exclude_from:
properties:
exploit_protection:
const: true
required:
- exploit_protection
- properties:
exclude_from:
properties:
malware_protection:
const: true
required:
- malware_protection
- properties:
exclude_from:
properties:
ransomware_protection:
const: true
required:
- ransomware_protection
- properties:
exclude_from:
properties:
website_protection:
const: true
required:
- website_protection
- properties:
exclude_from:
properties:
suspicious_activity:
const: true
required:
- suspicious_activity
- properties:
exclude_from:
properties:
bruteforce_protection:
const: true
required:
- bruteforce_protection
errorMessage:
if: if enabled is true
responses:
'200':
description: response schema
content:
application/json:
schema:
title: Exclusion from server
type: object
additionalProperties: true
properties:
id:
type: string
title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- c87998228b2f7511bb1616f686d06bae
type:
type: integer
title: '1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line'
examples:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 13
- 14
- 17
value:
type: string
title: String value
examples:
- '%PROGRAMDATA%'
enabled:
type: boolean
title: Enable
comment:
type: string
title: Comment
created_at:
type: string
title: Created at
updated_at:
type: string
title: Updated at
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
exclude_from:
type: object
title: Exclusion applied to
properties:
exploit_protection:
type:
- boolean
- 'null'
title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
malware_protection:
type:
- boolean
- 'null'
title: Protects against malware infections and zero-day threats
ransomware_protection:
type:
- boolean
- 'null'
title: Detects and blocks ransomware threats using advanced behavior analysis
suspicious_activity:
type:
- boolean
- 'null'
title: Uses advanced machine learning to identify suspicious processes that require additional review
website_protection:
type:
- boolean
- 'null'
title: Blocks network traffic from malicious websites and IP addresses
bruteforce_protection:
type:
- boolean
- 'null'
title: Bruteforce attack protection on RDP, IMAP and so on.
friendly_name:
type: string
title: Friendly name
examples:
- File by MD5 hash
account_level:
type: boolean
title: Account level
policies:
type: array
title: Policies
items:
type: object
title: Policy
properties:
id:
type: string
title: ID of policy (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
additionalProperties: true
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 20da4613-5fa5-4460-9016-963d2c4f6753
name:
type: string
title: Name of policy
tags:
- Exclusions
operationId: api.nebula.put.exclusions
/nebula/v1/exclusions:
servers:
- url: https://api.threatdown.com
delete:
description: Delete exclusions in bulk.
summary: Delete exclusions in bulk
security:
- client_credentials:
- write
- user_permissions:
- exclusions.delete
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Delete Exclusions Bulk
properties:
exclusion_ids:
type: array
title: Exclusion IDs
items:
type: string
format: uuid
responses:
'200':
description: Successful response
tags:
- Exclusions
operationId: api.nebula.delete.exclusions.bulk
get:
description: Get exclusions.
summary: Get exclusions
security:
- client_credentials:
- read
- user_permissions:
- exclusions.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
- name: search_string
required: false
in: query
description: Search with exclusion string.
schema:
type: string
- name: policy_ids
required: false
in: query
description: Search with exclusion policy ids.
schema:
type: string
- name: type
required: false
in: query
description: Search with exclusion type
schema:
type: number
- name: since
required: false
in: query
description: Timestamp to filter since exclusion times.
schema:
type: string
- name: until
required: false
in: query
description: Timestamp to filter until exclusion times.
schema:
type: string
- name: sort_by
required: false
in: query
description: Field to sort results with. 'risk' is resolved in-memory by Retina (risk is not persisted).
schema:
type: string
enum:
- enabled
- value
- created_at
- updated_at
- created_by
- updated_by
- type
- risk
- name: sort_order
required: false
in: query
description: Sorting direction
schema:
type: string
enum:
- asc
- desc
- name: populate_risk
required: false
in: query
description: Populate risk fields on exclusions
schema:
type: boolean
- name: risk
required: false
in: query
description: Filter exclusions by risk level (validated by Retina)
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
title: Get exclusions by account
type: object
required:
- exclusions
- total_count
- next_cursor
properties:
exclusions:
type: array
title: Exclusions
items:
title: Exclusion from server
type: object
additionalProperties: true
properties:
id:
type: string
title: UUID of the exclusion (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a exclusion. When updating, you need to fetch the latest value by GETting an exclusion. You should always get the current etag before trying to modify a resource that has an etag property.
examples:
- c87998228b2f7511bb1616f686d06bae
type:
type: integer
title: '1: Exclusion for file path, 2: Exclusion for folder path, 3: Exclusion for wildcard path, 4: Exclusion for registry, 5: Exclusion for file extensions, 6: Exclusion for web domain, 7: Exclusion for web IP, 8: Exclusion for Web Monitoring, 13: Exclusion for hash, 14: Exclusion for command line'
examples:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 13
- 14
- 17
value:
type: string
title: String value
examples:
- '%PROGRAMDATA%'
enabled:
type: boolean
title: Enable
comment:
type: string
title: Comment
created_at:
type: string
title: Created at
updated_at:
type: string
title: Updated at
created_by:
type: string
title: Created by
updated_by:
type: string
title: Updated by
exclude_from:
type: object
title: Exclusion applied to
properties:
exploit_protection:
type:
- boolean
- 'null'
title: Uses multiple protection layers to guard against attempted exploits of vulnerabilities in legitimate applications
malware_protection:
type:
- boolean
- 'null'
title: Protects against malware infections and zero-day threats
ransomware_protection:
type:
- boolean
- 'null'
title: Detects and blocks ransomware threats using advanced behavior analysis
suspicious_activity:
type:
- boolean
- 'null'
title: Uses advanced machine learning to identify suspicious processes that require additional review
website_protection:
type:
- boolean
- 'null'
title: Blocks network traffic from malicious websites and IP addresses
bruteforce_protection:
type:
- boolean
- 'null'
title: Bruteforce attack protection on RDP, IMAP and so on.
friendly_name:
type: string
title: Friendly name
examples:
- File by MD5 hash
account_level:
type: boolean
title: Account level
policies:
type: array
title: Policies
items:
type: object
title: Policy
properties:
id:
type: string
title: ID of policy (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
additionalProperties: true
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
examples:
- 20da4613-5fa5-4460-9016-963d2c4f6753
name:
type: string
title: Name of policy
total_count:
type: integer
title: Total Count
description: Total count of results.
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- e
# --- truncated at 32 KB (100 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-exclusions-api-openapi.yml