Create a new allowlist

POST

/allowlists

Creates a new allowlist to exclude matching items from alerts and detections.
Allowlists can be configured with filtering rules and optional snooze duration.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Allowlist created successfully

Body

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST '/allowlists' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "entity": "unspecified",
    "name": "Company IP addresses",
    "query": "ip_address='\''192.168.1.0/24'\''"
}'

Response Example

200 - Example 1

{
    "entity": "unspecified",
    "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
    "items_allowlisted": 42,
    "name": "Company IP addresses",
    "query": "ip_address='192.168.1.0/24'"
}

Modified at 2026-03-31 19:28:57

Query all allowlists

Delete an allowlist