Exclude assets from assessments

Exclusion rules tell Attack Surface assessments what to leave out of their reports: a test server, a former employee, a partner’s domain, a finding you have accepted. Include rules do the opposite for hosts: they add a host or IP address that discovery missed. Rules belong to your organization. Each one applies to every assessment, or only to the assessments of one domain. You don’t pass rules when you start an assessment. They are applied every time a report is built, so after you change them you generate the report again. No new assessment is needed, except for include rules. In the dashboard, rules are the Exclusions step when you start an assessment under Exposure → Risk Assessments.

Not the same as other exclusions

Three features leave things out, and each works differently:

Feature	Applies to	Takes effect
Assessment exclusion rules (this page)	Attack Surface assessments, for your organization or one domain	Every time a report is built, including reports of past assessments
Exclusion lists	The matches of one monitor	Forward only: new matches
Trusted domains	The look-alike results of Domain monitoring scans	At once, on the scan they are attached to

A rule on this page never changes monitor matches or Domain monitoring results, and the other two never change an assessment report.

Availability and cost

Availability: Attack Surface Reports or Targeted Attack Surface Reports, included in every edition. Either feature opens every endpoint on this page. Cost: no metered allowance. Rules use none of your Attack Surface allowances and have no limit on how many you keep. With an API key, each call that returns 2xx counts once toward your monthly API Calls allowance. Any other status is refunded. See Rate limits. Without either feature, every call on this page returns 403 with {"detail": "This feature is not included in your plan."}. A lapsed license returns the same message here. These endpoints never return the allowance 429 or a capacity 409. See Plans and quotas.

Create a rule

POST /api/hackerview/exclusions/ creates one rule.

curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "value_type": "hostname",
    "value": "vpn-test.acme.com",
    "label": "Test system"
  }'

Field	Value	Default
`value_type`	Required. What `value` is. See Value types.	None
`value`	Required. Up to 512 characters.	None
`target_domain`	The domain whose assessments the rule applies to. Empty for every assessment. See Scope a rule to a domain.	`""`
`list_type`	`exclude` or `include`	`exclude`
`label`	Your note, up to 30 characters	`""`
`suppress_findings`	Host rules only. See Keep a host visible but excluded.	`true`
`extra`	An object. Required for `finding` rules. On other rules it holds your own notes, such as `{"justification": "Decommissioned"}`.	`{}`

The call returns 201 with the rule:

{
  "id": 4127,
  "ext_org_id": "812",
  "target_domain": "acme.com",
  "list_type": "exclude",
  "value": "vpn-test.acme.com",
  "value_type": "hostname",
  "label": "Test system",
  "suppress_findings": true,
  "extra": {},
  "created_at": "2026-10-08T11:20:05.104311Z",
  "updated_at": "2026-10-08T11:20:05.104311Z"
}

Keep the id to delete the rule later. ext_org_id is your organization’s ID.

Value types

value_type decides how value is read and matched, and which reports the rule changes. The value comes back in its stored form.

`value_type`	Example `value`	Stored and matched as	Reports it changes
`hostname`	`vpn-test.acme.com`	Lowercased. Must contain a dot. Matches that exact host name, not its subdomains.	Full, Infrastructure, Application Security, Breach, Domain Spoofing
`ip`	`203.0.113.24`	An IPv4 or IPv6 address, matched exactly	Same as `hostname`
`cidr`	`203.0.113.0/24`	A network range. Matches every address in it.	Same as `hostname`
`person`	`Jane Doe`	Free text, kept as you typed it. Matched loosely: case and punctuation are ignored, and names match when either contains the other. Use full names: `Sam` matches every Sam.	Full, VIP Executive
`email`	`jane.doe@acme.com`	Lowercased, matched exactly. Also drops the person the address belongs to.	Full, VIP Executive, Breach
`cve`	`CVE-2026-12345`	Uppercased. Must look like `CVE-YYYY-NNNN`.	Full, Application Security
`finding`	Built from `extra`	`<module>:<host>:<check_id>`, lowercased. See Exclude one finding.	Full, Application Security
`domain`	`acme-login.com`	Lowercased. A scheme, path, port and leading `www.` are removed. Matches the domain and its subdomains.	Full, Breach, Domain Spoofing
`social`	`@acme` or `linkedin.com/company/acme`	A handle is lowercased without the `@`. An account URL loses its scheme and matches as a prefix.	Full, Social Media
`url`	`github.com/acme/sample-repo`	Scheme, query, fragment and trailing `/` removed, then lowercased. Matches the URL and everything under it.	Full, Exposed Assets, Domain Spoofing

A domain rule marks a domain as legitimate. It drops breach results for that domain, and the Domain Spoofing Risk Report stops flagging it as a look-alike. Use it for a domain that resembles yours but is yours or a partner’s, such as acme-login.com for your own sign-in pages.
A cve rule removes the CVE from the vulnerability findings. A finding from another module that mentions the same CVE can remain. To remove that finding too, add a finding rule.
Activity and Change Comparison reports apply the rules that match their own data, and count what they removed in exclusions_applied. See Read assessment report data.

Exclude one finding

A finding rule removes a single web application, TLS or admin panel finding. Send its three parts in extra. value is required but replaced by the stored form, so send the stored form itself:

curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "value_type": "finding",
    "value": "web_app_security:portal.acme.com:hsts_missing",
    "extra": {
      "host": "portal.acme.com",
      "module": "web_app_security",
      "check_id": "HSTS_MISSING"
    },
    "label": "Accepted risk"
  }'

module is web_app_security, tls_posture or admin_panels. Other values are accepted but match nothing.
host and check_id come from the finding in a report. Read them from modules.web_app_security, modules.tls_posture or modules.admin_panels with the report data endpoints. An admin panel finding without a check_id uses its panel_type.

Scope a rule to a domain

target_domain decides which assessments a rule applies to:

Empty or omitted: every assessment your organization runs.
A domain: the assessments that cover it. A rule applies when its target_domain is one of the assessment’s domains or a subdomain of one. An assessment’s domains are the assessed domain, the domain you submitted, the other domains it covered (for example with domain_mode all, see Domain handling), and the domains you approved in active_scope_domains.

A rule for www.acme.com therefore applies to an assessment of acme.com, and then matches its value across that whole assessment, not only under www. With domain_mode all, a rule scoped to another of your domains also applies to an assessment of acme.com that covered that domain. target_domain is lowercased. It must be a domain such as acme.com: letters, digits, dots and hyphens, with at least one dot, up to 253 characters.

Keep a host visible but excluded

suppress_findings applies to hostname, ip and cidr rules:

`suppress_findings`	The host in reports	Scores
`true` (default)	Removed from the report and the scorecard	Its findings no longer count
`false`	Kept, marked as excluded (`is_excluded: true` in `servers`)	Unchanged

Rules of every other type always remove what they match. suppress_findings has no effect on them.

Add a host the assessment missed

An include rule adds a host or IP address to the assessment when discovery does not find it. The assessment then checks it like any other host.

curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "list_type": "include",
    "value_type": "hostname",
    "value": "legacy-portal.acme.com"
  }'

Only hostname and ip work as include rules. The API accepts other value types with "list_type": "include", but they have no effect. To assess several domains, use domain_mode when you start an assessment. See Domain handling.
Include rules apply while an assessment runs. Generating a report again does not add the host. Start a new assessment.
Scope works the same way as for exclusion rules.

Update a rule

There is no update endpoint. Send the same rule again: a POST with the same target_domain, list_type, value_type and value returns 200 with the existing rule instead of creating a second one, and updates these fields:

label, when you send one that is not empty.
extra, when you send one that is not empty.
suppress_findings, when you send it.

The values are compared in their stored form, so VPN-Test.acme.com and vpn-test.acme.com are the same rule. To change target_domain, list_type, value_type or value, or to clear a label, delete the rule and create a new one.

Delete a rule

DELETE /api/hackerview/exclusions/{entry_id}/ deletes one rule by its id and returns 204. There is no bulk delete: to clear several rules, list them and delete each.

curl -X DELETE https://client-api.leak.center/api/hackerview/exclusions/4127/ \
  -H "X-API-Key: YOUR_API_KEY"

List rules

GET /api/hackerview/exclusions/ returns your organization’s rules, newest first.

curl -G https://client-api.leak.center/api/hackerview/exclusions/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "target_domain=acme.com" \
  --data-urlencode "list_type=exclude"

Parameter	Filters on	Notes
`target_domain`	The exact `target_domain`	Send it empty (`target_domain=`) for the rules that apply to every assessment. A rule for `www.acme.com` is not returned for `acme.com`.
`value_type`	One value type	An unknown value is ignored and returns every type.
`list_type`	`exclude` or `include`	An unknown value is ignored.
`page`, `page_size`		`page_size` defaults to `10`, max `100`.

Page by raising page until next is null. The next and previous URLs point at an internal address, so don’t call them.

Apply rule changes

A rule change does not touch finished reports. To see it:

Change the rules

Create, update or delete rules as above.

Generate the report again

Send Generate a report with the same scan_uid and options. It uses no assessment allowance.

Check what was removed

When the new report is completed, read its exclusions_applied counters.

Rules that exist when an assessment runs also act during it: host rules mark hosts as excluded, and an email rule keeps that person out of the executive research. Rules you add later still apply to every report you build from that assessment.

Errors

Status	When	Body
`400`	`value_type` or `value` is missing, or `value_type` is not one of the ten	Field errors, such as `{"value_type": ["\"server\" is not a valid choice."]}`
`400`	`value` does not fit its type	`{"value": ["..."]}`, such as `"Invalid IP address."`, `"Invalid CIDR."` or `"Hostname must contain a dot."`
`400`	A `finding` rule without `host`, `module` and `check_id` in `extra`	`{"extra": ["..."]}` naming the three keys
`400`	`target_domain` is not a domain	`{"target_domain": ["..."]}`
`400`	`label` is longer than 30 characters, or `value` longer than 512	`{"label": ["Ensure this field has no more than 30 characters."]}`
`400`	`extra` is not an object	`{"extra": ["Expected a dictionary of items but got type \"list\"."]}`
`403`	Your plan has neither Attack Surface feature, or your license is not active	See Availability and cost
`404`	No rule with that `id` in your organization	`{"details": "Entry not found."}`
`404`	`entry_id` is not a whole number	An HTML page
`429`	The per-second rate limit or the API Calls allowance	See Rate limits
`502`, `504`	The assessment service failed or timed out	See Errors

Endpoints

Action	Endpoint
Create or update a rule	`POST /api/hackerview/exclusions/`
List rules	`GET /api/hackerview/exclusions/`
Delete a rule	`DELETE /api/hackerview/exclusions/{entry_id}/`
Generate a report with the current rules	`POST /api/hackerview/reports/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Exclude assets from assessments

Not the same as other exclusions

Availability and cost

Create a rule

Value types

Exclude one finding

Scope a rule to a domain

Keep a host visible but excluded

Add a host the assessment missed

Update a rule

Delete a rule

List rules

Apply rule changes

Errors

Endpoints

​Not the same as other exclusions

​Availability and cost

​Create a rule

​Value types

​Exclude one finding

​Scope a rule to a domain

​Keep a host visible but excluded

​Add a host the assessment missed

​Update a rule

​Delete a rule

​List rules

​Apply rule changes

​Errors

​Endpoints

Not the same as other exclusions

Availability and cost

Create a rule

Value types

Exclude one finding

Scope a rule to a domain

Keep a host visible but excluded

Add a host the assessment missed

Update a rule

Delete a rule

List rules

Apply rule changes

Errors

Endpoints