Replace

curl --request PUT \
  --url https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "exemptions": [
    {
      "type": "NAME_EXEMPTION",
      "condition": "starts-with",
      "value": "acme-sandbox-",
      "reason": "ACCEPTED_RISK"
    }
  ]
}
'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions"

payload = { "exemptions": [
        {
            "type": "NAME_EXEMPTION",
            "condition": "starts-with",
            "value": "acme-sandbox-",
            "reason": "ACCEPTED_RISK"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    exemptions: [
      {
        type: 'NAME_EXEMPTION',
        condition: 'starts-with',
        value: 'acme-sandbox-',
        reason: 'ACCEPTED_RISK'
      }
    ]
  })
};

fetch('https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'exemptions' => [
        [
                'type' => 'NAME_EXEMPTION',
                'condition' => 'starts-with',
                'value' => 'acme-sandbox-',
                'reason' => 'ACCEPTED_RISK'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions"

	payload := strings.NewReader("{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "profileId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "detectionId": "PLERION-AWS-16",
    "provider": "AWS",
    "supportsExemptions": true,
    "supportedExemptionTypes": [
      "NAME_EXEMPTION",
      "TAG_EXEMPTION",
      "REGION_EXEMPTION"
    ],
    "exemptions": [
      {
        "reason": "ACCEPTED_RISK",
        "condition": "starts-with",
        "value": "acme-sandbox-",
        "tagKey": {
          "option": "equals",
          "value": "environment"
        },
        "tagValue": {
          "option": "equals",
          "value": "test"
        },
        "regions": [
          "<string>"
        ],
        "apiId": "<string>",
        "routeKey": "<string>",
        "createdBy": "<string>",
        "createdAt": "<string>"
      }
    ],
    "version": "<string>"
  }
}

{
  "errors": [
    {
      "field": "<string>",
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "errors": [
    {
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "errors": [
    {
      "code": "VersionMismatch",
      "message": "This detection was changed since the version you supplied. Re-read the exemptions and retry."
    }
  ]
}

{
  "message": "Internal server error"
}

Replace a detection's exemptions on a profile

Replace the whole exemption set for one detection on one profile. The body is the set you want to end up with, so read the current set, change it, and send all of it back. An empty array clears the set; there is no endpoint for a single entry and no exemption ID.

Send the version from the read as If-Match. The write is then rejected with a 412 (VersionMismatch) if the detection’s configuration changed in the meantime, so re-read and retry. Without the header the write applies unconditionally: a concurrent change is overwritten and no 412 is returned. Send it whenever the read returned a version, and omit it only when version was null, since there is then no stored configuration to match against.

version covers the detection’s whole configuration, not just its exemptions, so a change to its severity or parameters also invalidates it. Saving the profile in the Plerion platform rewrites every detection configured on it, which invalidates any version held against that profile.

A non-empty set is rejected with a 400 when the detection does not accept exemptions (ExemptionsNotSupported) or when an entry’s type is outside the detection’s supportedExemptionTypes (UnsupportedExemptionType). Both would otherwise be stored and then never take effect. Clearing is always allowed, whatever the detection supports today.

Only the exemptions change. A severity override or parameter set on the same detection is left alone, and exemptions written here apply to findings Plerion has already stored rather than waiting for the next scan.

PUT

tenant

profiles

{profileId}

detection-settings

{detectionId}

exemptions

Replace

curl --request PUT \
  --url https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "exemptions": [
    {
      "type": "NAME_EXEMPTION",
      "condition": "starts-with",
      "value": "acme-sandbox-",
      "reason": "ACCEPTED_RISK"
    }
  ]
}
'

import requests

url = "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions"

payload = { "exemptions": [
        {
            "type": "NAME_EXEMPTION",
            "condition": "starts-with",
            "value": "acme-sandbox-",
            "reason": "ACCEPTED_RISK"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    exemptions: [
      {
        type: 'NAME_EXEMPTION',
        condition: 'starts-with',
        value: 'acme-sandbox-',
        reason: 'ACCEPTED_RISK'
      }
    ]
  })
};

fetch('https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'exemptions' => [
        [
                'type' => 'NAME_EXEMPTION',
                'condition' => 'starts-with',
                'value' => 'acme-sandbox-',
                'reason' => 'ACCEPTED_RISK'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions"

	payload := strings.NewReader("{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{region}.api.plerion.com/v1/tenant/profiles/{profileId}/detection-settings/{detectionId}/exemptions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"exemptions\": [\n    {\n      \"type\": \"NAME_EXEMPTION\",\n      \"condition\": \"starts-with\",\n      \"value\": \"acme-sandbox-\",\n      \"reason\": \"ACCEPTED_RISK\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "profileId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "detectionId": "PLERION-AWS-16",
    "provider": "AWS",
    "supportsExemptions": true,
    "supportedExemptionTypes": [
      "NAME_EXEMPTION",
      "TAG_EXEMPTION",
      "REGION_EXEMPTION"
    ],
    "exemptions": [
      {
        "reason": "ACCEPTED_RISK",
        "condition": "starts-with",
        "value": "acme-sandbox-",
        "tagKey": {
          "option": "equals",
          "value": "environment"
        },
        "tagValue": {
          "option": "equals",
          "value": "test"
        },
        "regions": [
          "<string>"
        ],
        "apiId": "<string>",
        "routeKey": "<string>",
        "createdBy": "<string>",
        "createdAt": "<string>"
      }
    ],
    "version": "<string>"
  }
}

{
  "errors": [
    {
      "field": "<string>",
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "errors": [
    {
      "code": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "errors": [
    {
      "code": "VersionMismatch",
      "message": "This detection was changed since the version you supplied. Re-read the exemptions and retry."
    }
  ]
}

{
  "message": "Internal server error"
}

Authorizations

Authorization

string

header

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Headers

Authorization

string

required

Bearer API Key. For example, "Bearer {Tenant API Key}"

Content-Type

string

application/json

If-Match

string

The version returned by the read, echoed back unchanged. When supplied, the write is rejected with a 412 unless it still matches the stored value. When omitted, the write applies unconditionally. Omit it only when the detection has no stored configuration on the profile yet.

Path Parameters

profileId

string

required

Profile ID, or the literal string default for the tenant's default profile. default covers only the integrations that have not been given a profile of their own, so on a tenant with more than one profile it does not reach the rest. Use List profiles to get the IDs.

Example:

"default"

detectionId

string

required

Detection ID. A finding reports the detection that produced it in its detectionId field.

Example:

"PLERION-AWS-16"

Body

application/json

exemptions

object[]

required

The complete exemption set for the detection. Send an empty array to clear it.

One exemption rule to write. The type decides which other fields apply, and which types a detection accepts is reported by supportedExemptionTypes on the read. The read returns StoredDetectionExemption, which is looser.

Option 1
Option 2
Option 3
Option 4
Option 5

Show child attributes

Response

Exemptions replaced

data

object

The exemptions configured for one detection on one profile.

Show child attributes

Overview

API documentation

Replace a detection's exemptions on a profile

Authorizations

Headers

Path Parameters

Body

Response