> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# plerion profiles

> List profiles and manage a detection's exemptions.

With **plerion profiles**, you can list the profiles in your tenant and read or replace the exemptions on one detection in a profile.

<Tip>
  For more about exemptions in the Plerion dashboard, see [Exempting findings](/guides/platform/findings/exempting-findings).
</Tip>

<Note>
  These are the profiles that decide which detections run on your integrations. They're unrelated to the global `--profile` option, which picks a set of saved CLI credentials.
</Note>

***

## Synopsis

```bash theme={"system"}
plerion profiles <subcommand> [options]
```

***

## Subcommands

### list

```bash theme={"system"}
plerion profiles list
```

Lists each profile and the number of integrations it applies to. Use `--output json` to see the integrations.

### detection-exemptions get

```bash theme={"system"}
plerion profiles detection-exemptions get --profile-id <id> --detection-id <id>
```

Returns the detection's exemptions, the exemption types it accepts, and its current `version`.

| Option | Type | Description |
| - | - | - |
| `--profile-id` | string | **(required)** Profile ID, or `default` for the tenant's default profile |
| `--detection-id` | string | **(required)** Detection ID (e.g. `PLERION-AWS-16`) |

### detection-exemptions replace

```bash theme={"system"}
plerion profiles detection-exemptions replace --profile-id <id> --detection-id <id> \
  (--exemptions <json> | --file <path> | --clear) [--if-match <version>]
```

Replaces the detection's whole exemption set. Any exemption you leave out is removed, so read the set with `get --output json`, edit it, and send all of it back.

| Option | Type | Description |
| - | - | - |
| `--profile-id` | string | **(required)** Profile ID, or `default` for the tenant's default profile |
| `--detection-id` | string | **(required)** Detection ID (e.g. `PLERION-AWS-16`) |
| `--exemptions` | string | The complete exemption set as JSON: an array, or an object with an `exemptions` array (such as the output of `get --output json`). Can't be combined with `--file` |
| `--file` | string | Read the exemption set JSON from a file, or `-` for stdin |
| `--clear` | flag | Remove every exemption on the detection. Can't be combined with `--exemptions` or `--file` |
| `--if-match` | string | The `version` from your last `get`. Omit it only when that version was empty |

<Warning>
  Pass `--if-match` whenever `get` returned a version. The replace is then refused if the detection changed since you read it, so re-read and try again. Without it, the replace overwrites any change made in the meantime.
</Warning>

<Note>
  An empty set is rejected so that you can't remove every exemption by accident. Use `--clear` to do that.
</Note>

#### Exemption types

Each exemption is a JSON object with a `type` and an optional `reason` (`ACCEPTED_RISK`, `FALSE_POSITIVE`, or `COMPENSATING_CONTROL`). A detection only accepts the types listed under `SUPPORTED TYPES` in the `get` output.

| Type | Fields |
| - | - |
| `NAME_EXEMPTION` | `condition` (`equals`, `starts-with`, `ends-with`, `contains`) and `value`, matched against the asset name |
| `TAG_EXEMPTION` | `tagKey` (`{"option": "equals", "value": "<key>"}`) and `tagValue` (`option` is `equals`, `starts-with`, `ends-with`, `contains`, or `any`, plus `value`) |
| `REGION_EXEMPTION` | `regions`, a list of region names |
| `PRINCIPAL_EXEMPTION` | `condition` and `value`, matched against the principal. Cloud Detection and Response (CDR) detections only |
| `ROUTE_EXEMPTION` | `apiId` and `routeKey` for one API Gateway route |

***

## Examples

```bash theme={"system"}
# List profiles
plerion profiles list

# Read a detection's exemptions on the default profile
plerion profiles detection-exemptions get --profile-id default --detection-id PLERION-AWS-16

# Save the set, edit it, and send it back with the version you read
plerion profiles detection-exemptions get --profile-id default --detection-id PLERION-AWS-16 \
  --output json > exemptions.json
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 \
  --file exemptions.json --if-match "$(jq -r .version exemptions.json)"

# Replace the set with one name exemption
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 \
  --exemptions '[{"type":"NAME_EXEMPTION","condition":"starts-with","value":"acme-sandbox-","reason":"ACCEPTED_RISK"}]'

# Remove every exemption on the detection
plerion profiles detection-exemptions replace --profile-id default --detection-id PLERION-AWS-16 --clear
```

***

## Output columns (list)

| Column | Description |
| - | - |
| PROFILE ID | Profile ID |
| NAME | Profile name |
| DEFAULT | Whether this is the tenant's default profile |
| INTEGRATIONS | Number of integrations the profile applies to |
| DESCRIPTION | Profile description |

## Output columns (detection-exemptions)

Table output shows a summary row, then one row per exemption.

| Column | Description |
| - | - |
| PROFILE ID | Profile ID. `default` is reported as the ID it resolved to |
| DETECTION ID | Detection ID |
| PROVIDER | Provider the detection belongs to |
| SUPPORTS EXEMPTIONS | Whether the detection accepts exemptions |
| SUPPORTED TYPES | Exemption types the detection accepts |
| EXEMPTIONS | Number of exemptions |
| VERSION | Version to pass to `--if-match` |

| Column | Description |
| - | - |
| TYPE | Exemption type |
| REASON | Exemption reason |
| MATCH | What the exemption matches |
| CREATED BY | User who created the exemption |
| CREATED AT | Creation timestamp |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.