Overview
This endpoint permanently deletes a detection exclusion. Target the rule by its exclusionId in the path. The action is irreversible and a successful response returns 204 No Content. Use this API to remove an obsolete exclusion, such as when an application is decommissioned or a false positive has been resolved by a software update. This API helps maintain the integrity of your security policy by ensuring that detection capabilities are fully enabled and not suppressed by outdated rules.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
DELETE https://{Trellix EDR_gateway_URL}/edr/v2/remediation/exclusions/{exclusionId}
Example — {exclusionId}: 8e63d190-51e5-4f10-8367-e84f58795e4d
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key>
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.
Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
exclusionId | string | Unique identifier for threat exclusion |
Response
Response codes
Status | Response | Description |
|---|---|---|
204 | No Content | The specified exclusion was permanently deleted. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |