> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# List Finding Exclusions

POST https://%7Baccount-domain%7D.console.eon.io/api/v1/projects/{projectId}/finding-exclusions/list
Content-Type: application/json

Retrieves a list of finding exclusions in the Eon account.

Reference: https://docs.eon.io/api/api-reference/threat-detection/finding-exclusions/list-finding-exclusions

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Path parameters

- `projectId` (string, required) — ID of the project the finding exclusions are in. You can get your project ID from the [API Credentials](https://console.eon.io/global-management/api-credentials) page in your global management console.

### Query parameters

- `pageToken` (string, optional) — Cursor that points to the first record of the next page of results. Get this value from the previous response, and send it with the same `pageSize` and request body.
- `pageSize` (integer, optional, default: 50) — Maximum number of items to return in the response.

### Body (application/json)

This endpoint expects a ListFindingExclusionsRequest.

- `filters` (FindingExclusionFilterConditions, optional) — Filter conditions. If omitted, no filtering is applied.

## Response

### 200

Finding exclusions retrieved.

- `findingExclusions` (list of FindingExclusion, required) — List of finding exclusions.
- `totalCount` (integer, required) — Total number of finding exclusions that matched the filter options.
- `nextPageToken` (string, optional) — Cursor that points to the first record of the next page of results. Pass this value in the next request.

## Errors

### 400 Bad Request Error

Invalid request. Typically this indicates invalid filters or pagination parameters.

- `error` (string, optional)

## Types

### FindingExclusionFilterConditions

- `scope` (FindingExclusionScopeFilters, optional) — Filters for the exclusion scope.
- `resource` (FindingExclusionResourceFilter, optional) — Filters for the cloud-provider-assigned resource ID.
- `type` (FindingExclusionTypeFilters, optional) — Filters for the exclusion type.
- `detector` (FindingExclusionDetectorFilters, optional) — Filters for the detector.
- `value` (FindingExclusionValueFilters, optional) — Filters for the exclusion value.

### FindingExclusion

Exclusion that stops a detector from reporting findings for matching files, tables, or databases. Can be scoped either to a single resource or to all resources in your inventory.

- `id` (string, required) — ID of the finding exclusion.
- `scope` (enum, required) — Whether the exclusion applies to a single resource or to all resources in the Eon account. If set to `RESOURCE`, a resource ID must be set in `providerResourceId`.
  - Allowed values: `RESOURCE`, `ACCOUNT`
- `value` (string, required) — Matching value to exclude. The value set in this field depends on the specified `type`. - `PATH`: Matches files whose path starts with the specified value, case-sensitive. For example, `/data/tmp` matches `/data/tmp2/report.csv`. Linux paths are case-sensitive. Windows paths are case-insensitive, normalize for the file separator, and start with the drive letter. For example, `C:\Users\App\Cache` matches `c:/users/app/cache`. - `TABLE`: Exact table name. - `DATABASE`: Exact database name. - `KMS_KEY`: Either a KMS key ARN, or an AWS account ID to trust all keys in the account. Available for the ransomware detector only.
- `type` (enum, required) — Whether the finding is set to a file path, a database table, a whole database, or objects encrypted with a trusted KMS key. Used in combination with `value`.
  - Allowed values: `PATH`, `TABLE`, `DATABASE`, `KMS_KEY`
- `detector` (enum, required) — Detector type the exclusion applies to. If set to `MALWARE`, only paths can be excluded.
  - Allowed values: `RANSOMWARE_BEHAVIOR`, `DATA_ANOMALY`, `MALWARE`
- `updatedAt` (datetime, required) — Date and time the exclusion was updated.
- `providerResourceId` (string, optional) — Cloud-provider-assigned ID of the resource the exclusion applies to. Set when scope is `RESOURCE`.

### FindingExclusionScopeFilters

- `in` (list of enum, optional) — Matches if any value in this list equals `scope`.
  - Allowed values: `RESOURCE`, `ACCOUNT`
- `notIn` (list of enum, optional) — Matches if none of the values in this list equal `scope`.
  - Allowed values: `RESOURCE`, `ACCOUNT`

### FindingExclusionResourceFilter

- `in` (list of string, optional) — Matches if any string in this list equals `providerResourceId`. Account-wide exclusions never match.

### FindingExclusionTypeFilters

- `in` (list of enum, optional) — Matches if any value in this list equals `type`.
  - Allowed values: `PATH`, `TABLE`, `DATABASE`, `KMS_KEY`
- `notIn` (list of enum, optional) — Matches if none of the values in this list equal `type`.
  - Allowed values: `PATH`, `TABLE`, `DATABASE`, `KMS_KEY`

### FindingExclusionDetectorFilters

- `in` (list of enum, optional) — Matches if any value in this list equals `detector`.
  - Allowed values: `RANSOMWARE_BEHAVIOR`, `DATA_ANOMALY`, `MALWARE`
- `notIn` (list of enum, optional) — Matches if none of the values in this list equal `detector`.
  - Allowed values: `RANSOMWARE_BEHAVIOR`, `DATA_ANOMALY`, `MALWARE`

### FindingExclusionValueFilters

- `contains` (list of string, optional) — Matches if every string in this list is a substring of `value`.

## Examples

**Request**

```json
{}
```

**Response**

```json
{
  "findingExclusions": [
    {
      "id": "4c1f3b0e-8d9a-4f55-9b1e-2d6f3a7c8e10",
      "scope": "RESOURCE",
      "value": "/var/cache",
      "type": "PATH",
      "detector": "RANSOMWARE_BEHAVIOR",
      "updatedAt": "2024-01-15T09:30:00Z",
      "providerResourceId": "i-0abc123def4567890"
    }
  ],
  "totalCount": 12,
  "nextPageToken": "Y2NiMGYyZmMtYjYyZi00OTc5LTgzNjQtYmQ2YjEyYzdjZTNifDE="
}
```

**SDK Code**

```python
import requests

url = "https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/finding-exclusions/list"

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/finding-exclusions/list';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/finding-exclusions/list")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();
```