> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exclude assets from assessments

> Keep out-of-scope hosts, people, email addresses, CVEs, findings, partner domains, social accounts and URLs out of assessment reports, or add hosts an assessment missed, for your whole organization or one domain.

Exclusion rules tell Attack Surface assessments what to leave out of their reports: a test server, a former employee, a partner's domain, a finding you have accepted. Include rules do the opposite for hosts: they add a host or IP address that discovery missed.

Rules belong to your organization. Each one applies to every assessment, or only to the assessments of one domain. You don't pass rules when you start an assessment. They are applied every time a report is built, so after you change them you [generate the report again](https://wiki.darknetsearch.com/api/guides/attack-surface-reports.md#regenerate-a-report). No new assessment is needed, except for include rules.

In the dashboard, rules are the **Exclusions** step when you start an assessment under **Exposure → Risk Assessments**.

### Not the same as other exclusions

Three features leave things out, and each works differently:

| Feature | Applies to | Takes effect |
| - | - | - |
| **Assessment exclusion rules** (this page) | Attack Surface assessments, for your organization or one domain | Every time a report is built, including reports of past assessments |
| [Exclusion lists](https://wiki.darknetsearch.com/api/guides/monitoring-exclusions.md) | The matches of one [monitor](https://wiki.darknetsearch.com/api/guides/monitoring-rules.md) | Forward only: new matches |
| [Trusted domains](https://wiki.darknetsearch.com/api/guides/domain-monitoring-brand-library.md) | The look-alike results of [Domain monitoring](https://wiki.darknetsearch.com/api/guides/domain-monitoring.md) scans | At once, on the scan they are attached to |

A rule on this page never changes monitor matches or Domain monitoring results, and the other two never change an assessment report.

### Availability and cost

**Availability:** Attack Surface Reports or Targeted Attack Surface Reports, included in every edition. Either feature opens every endpoint on this page.

**Cost:** no metered allowance. Rules use none of your Attack Surface allowances and have no limit on how many you keep. With an API key, each call that returns `2xx` counts once toward your monthly API Calls allowance. Any other status is refunded. See [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md).

Without either feature, every call on this page returns `403` with `{"detail": "This feature is not included in your plan."}`. A lapsed license returns the same message here. These endpoints never return the allowance `429` or a capacity `409`. See [Plans and quotas](https://wiki.darknetsearch.com/api/guides/plans-and-quotas).

### Create a rule

[`POST /api/hackerview/exclusions/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/POST/api/hackerview/exclusions/) creates one rule.

```bash theme={"dark"}
curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "value_type": "hostname",
    "value": "vpn-test.acme.com",
    "label": "Test system"
  }'
```

| Field | Value | Default |
| - | - | - |
| `value_type` | Required. What `value` is. See [Value types](#value-types). | None |
| `value` | Required. Up to 512 characters. | None |
| `target_domain` | The domain whose assessments the rule applies to. Empty for every assessment. See [Scope a rule to a domain](#scope-a-rule-to-a-domain). | `""` |
| `list_type` | `exclude` or `include` | `exclude` |
| `label` | Your note, up to 30 characters | `""` |
| `suppress_findings` | Host rules only. See [Keep a host visible but excluded](#keep-a-host-visible-but-excluded). | `true` |
| `extra` | An object. Required for `finding` rules. On other rules it holds your own notes, such as `{"justification": "Decommissioned"}`. | `{}` |

The call returns `201` with the rule:

```json theme={"dark"}
{
  "id": 4127,
  "ext_org_id": "812",
  "target_domain": "acme.com",
  "list_type": "exclude",
  "value": "vpn-test.acme.com",
  "value_type": "hostname",
  "label": "Test system",
  "suppress_findings": true,
  "extra": {},
  "created_at": "2026-10-08T11:20:05.104311Z",
  "updated_at": "2026-10-08T11:20:05.104311Z"
}
```

Keep the `id` to delete the rule later. `ext_org_id` is your organization's ID.

### Value types

`value_type` decides how `value` is read and matched, and which reports the rule changes. The value comes back in its stored form.

| `value_type` | Example `value` | Stored and matched as | Reports it changes |
| - | - | - | - |
| `hostname` | `vpn-test.acme.com` | Lowercased. Must contain a dot. Matches that exact host name, not its subdomains. | Full, Infrastructure, Application Security, Breach, Domain Spoofing |
| `ip` | `203.0.113.24` | An IPv4 or IPv6 address, matched exactly | Same as `hostname` |
| `cidr` | `203.0.113.0/24` | A network range. Matches every address in it. | Same as `hostname` |
| `person` | `Jane Doe` | Free text, kept as you typed it. Matched loosely: case and punctuation are ignored, and names match when either contains the other. Use full names: `Sam` matches every Sam. | Full, VIP Executive |
| `email` | `jane.doe@acme.com` | Lowercased, matched exactly. Also drops the person the address belongs to. | Full, VIP Executive, Breach |
| `cve` | `CVE-2026-12345` | Uppercased. Must look like `CVE-YYYY-NNNN`. | Full, Application Security |
| `finding` | Built from `extra` | `<module>:<host>:<check_id>`, lowercased. See [Exclude one finding](#exclude-one-finding). | Full, Application Security |
| `domain` | `acme-login.com` | Lowercased. A scheme, path, port and leading `www.` are removed. Matches the domain and its subdomains. | Full, Breach, Domain Spoofing |
| `social` | `@acme` or `linkedin.com/company/acme` | A handle is lowercased without the `@`. An account URL loses its scheme and matches as a prefix. | Full, Social Media |
| `url` | `github.com/acme/sample-repo` | Scheme, query, fragment and trailing `/` removed, then lowercased. Matches the URL and everything under it. | Full, Exposed Assets, Domain Spoofing |

* **A `domain` rule marks a domain as legitimate.** It drops breach results for that domain, and the Domain Spoofing Risk Report stops flagging it as a look-alike. Use it for a domain that resembles yours but is yours or a partner's, such as `acme-login.com` for your own sign-in pages.
* **A `cve` rule removes the CVE from the vulnerability findings.** A finding from another module that mentions the same CVE can remain. To remove that finding too, add a [`finding` rule](#exclude-one-finding).
* **Activity and Change Comparison reports** apply the rules that match their own data, and count what they removed in `exclusions_applied`. See [Read assessment report data](https://wiki.darknetsearch.com/api/guides/attack-surface-report-data.md#what-a-report-left-out).

#### Exclude one finding

A `finding` rule removes a single web application, TLS or admin panel finding. Send its three parts in `extra`. `value` is required but replaced by the stored form, so send the stored form itself:

```bash theme={"dark"}
curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "value_type": "finding",
    "value": "web_app_security:portal.acme.com:hsts_missing",
    "extra": {
      "host": "portal.acme.com",
      "module": "web_app_security",
      "check_id": "HSTS_MISSING"
    },
    "label": "Accepted risk"
  }'
```

* **`module`** is `web_app_security`, `tls_posture` or `admin_panels`. Other values are accepted but match nothing.
* **`host` and `check_id`** come from the finding in a report. Read them from `modules.web_app_security`, `modules.tls_posture` or `modules.admin_panels` with the [report data endpoints](https://wiki.darknetsearch.com/api/guides/attack-surface-report-data.md#read-a-section). An admin panel finding without a `check_id` uses its `panel_type`.

### Scope a rule to a domain

`target_domain` decides which assessments a rule applies to:

* **Empty or omitted:** every assessment your organization runs.
* **A domain:** the assessments that cover it. A rule applies when its `target_domain` is one of the assessment's domains or a subdomain of one. An assessment's domains are the assessed domain, the domain you submitted, the other domains it covered (for example with `domain_mode` `all`, see [Domain handling](https://wiki.darknetsearch.com/api/guides/attack-surface-assessments.md#domain-handling)), and the domains you approved in [`active_scope_domains`](https://wiki.darknetsearch.com/api/guides/attack-surface-assessments#active-scope).

A rule for `www.acme.com` therefore applies to an assessment of `acme.com`, and then matches its `value` across that whole assessment, not only under `www`. With `domain_mode` `all`, a rule scoped to another of your domains also applies to an assessment of `acme.com` that covered that domain.

`target_domain` is lowercased. It must be a domain such as `acme.com`: letters, digits, dots and hyphens, with at least one dot, up to 253 characters.

### Keep a host visible but excluded

`suppress_findings` applies to `hostname`, `ip` and `cidr` rules:

| `suppress_findings` | The host in reports | Scores |
| - | - | - |
| `true` (default) | Removed from the report and the scorecard | Its findings no longer count |
| `false` | Kept, marked as excluded (`is_excluded: true` in `servers`) | Unchanged |

Rules of every other type always remove what they match. `suppress_findings` has no effect on them.

### Add a host the assessment missed

An include rule adds a host or IP address to the assessment when discovery does not find it. The assessment then checks it like any other host.

```bash theme={"dark"}
curl https://client-api.leak.center/api/hackerview/exclusions/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_domain": "acme.com",
    "list_type": "include",
    "value_type": "hostname",
    "value": "legacy-portal.acme.com"
  }'
```

* **Only `hostname` and `ip` work as include rules.** The API accepts other value types with `"list_type": "include"`, but they have no effect. To assess several domains, use `domain_mode` when you start an assessment. See [Domain handling](https://wiki.darknetsearch.com/api/guides/attack-surface-assessments.md#domain-handling).
* **Include rules apply while an assessment runs.** Generating a report again does not add the host. Start a new assessment.
* **Scope works the same way** as for exclusion rules.

### Update a rule

There is no update endpoint. Send the same rule again: a `POST` with the same `target_domain`, `list_type`, `value_type` and `value` returns `200` with the existing rule instead of creating a second one, and updates these fields:

* **`label`**, when you send one that is not empty.
* **`extra`**, when you send one that is not empty.
* **`suppress_findings`**, when you send it.

The values are compared in their stored form, so `VPN-Test.acme.com` and `vpn-test.acme.com` are the same rule. To change `target_domain`, `list_type`, `value_type` or `value`, or to clear a label, delete the rule and create a new one.

### Delete a rule

[`DELETE /api/hackerview/exclusions/{entry_id}/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/DELETE/api/hackerview/exclusions/\{entry_id}/) deletes one rule by its `id` and returns `204`. There is no bulk delete: to clear several rules, list them and delete each.

```bash theme={"dark"}
curl -X DELETE https://client-api.leak.center/api/hackerview/exclusions/4127/ \
  -H "X-API-Key: YOUR_API_KEY"
```

### List rules

[`GET /api/hackerview/exclusions/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/GET/api/hackerview/exclusions/) returns your organization's rules, newest first.

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/hackerview/exclusions/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "target_domain=acme.com" \
  --data-urlencode "list_type=exclude"
```

| Parameter | Filters on | Notes |
| - | - | - |
| `target_domain` | The exact `target_domain` | Send it empty (`target_domain=`) for the rules that apply to every assessment. A rule for `www.acme.com` is not returned for `acme.com`. |
| `value_type` | One value type | An unknown value is ignored and returns every type. |
| `list_type` | `exclude` or `include` | An unknown value is ignored. |
| `page`, `page_size` | | `page_size` defaults to `10`, max `100`. |

Page by raising `page` until `next` is `null`. The `next` and `previous` URLs point at an internal address, so don't call them.

### Apply rule changes

A rule change does not touch finished reports. To see it:

**1. Change the rules**

Create, update or delete rules as above.

**2. Generate the report again**

Send [Generate a report](https://wiki.darknetsearch.com/api/guides/attack-surface-reports.md#generate-a-report) with the same `scan_uid` and options. It uses no assessment allowance.

**3. Check what was removed**

When the new report is `completed`, read its [`exclusions_applied`](https://wiki.darknetsearch.com/api/guides/attack-surface-report-data#what-a-report-left-out) counters.

Rules that exist when an assessment runs also act during it: host rules mark hosts as excluded, and an `email` rule keeps that person out of the executive research. Rules you add later still apply to every report you build from that assessment.

### Errors

| Status | When | Body |
| - | - | - |
| `400` | `value_type` or `value` is missing, or `value_type` is not one of the ten | Field errors, such as `{"value_type": ["\"server\" is not a valid choice."]}` |
| `400` | `value` does not fit its type | `{"value": ["..."]}`, such as `"Invalid IP address."`, `"Invalid CIDR."` or `"Hostname must contain a dot."` |
| `400` | A `finding` rule without `host`, `module` and `check_id` in `extra` | `{"extra": ["..."]}` naming the three keys |
| `400` | `target_domain` is not a domain | `{"target_domain": ["..."]}` |
| `400` | `label` is longer than 30 characters, or `value` longer than 512 | `{"label": ["Ensure this field has no more than 30 characters."]}` |
| `400` | `extra` is not an object | `{"extra": ["Expected a dictionary of items but got type \"list\"."]}` |
| `403` | Your plan has neither Attack Surface feature, or your license is not active | See [Availability and cost](#availability-and-cost) |
| `404` | No rule with that `id` in your organization | `{"details": "Entry not found."}` |
| `404` | `entry_id` is not a whole number | An HTML page |
| `429` | The per-second rate limit or the API Calls allowance | See [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md) |
| `502`, `504` | The assessment service failed or timed out | See [Errors](https://wiki.darknetsearch.com/api/guides/errors.md#500-502-503-and-504) |

### Endpoints

| Action | Endpoint |
| - | - |
| Create or update a rule | [`POST /api/hackerview/exclusions/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/POST/api/hackerview/exclusions/) |
| List rules | [`GET /api/hackerview/exclusions/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/GET/api/hackerview/exclusions/) |
| Delete a rule | [`DELETE /api/hackerview/exclusions/{entry_id}/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/DELETE/api/hackerview/exclusions/\{entry_id}/) |
| Generate a report with the current rules | [`POST /api/hackerview/reports/`](https://client-api.leak.center/scalar-docs/#tag/attack-surface/POST/api/hackerview/reports/) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.