---
title: "List the exclusions of an attack surface"
method: GET
path: "/v1/attacksurfaces/{attack_surface_id}/excludes"
tags: ["Exposure Management"]
---

# List the exclusions of an attack surface

`GET /v1/attacksurfaces/{attack_surface_id}/excludes`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v1/attacksurfaces/{attack_surface_id}/excludes`
- Auth: HTTP bearer

Retrieve the assets that were excluded from an attack surface. Each `asset` is in the form you would send to add or remove it, except for types that cannot be named in a request (see `type`).<br><br>This endpoint does not cost credits to execute.

## Path parameters

- `attack_surface_id` string, required: The ID of the attack surface, or the literal 'default' for your organization's attack surface. Obtain the attack surface ID using the list attack surfaces endpoint.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `page_size` integer: Maximum number of assets to return per page.
- `page_token` string: Pagination token from a previous response to retrieve the next page of results.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Assets listed successfully

- ResponseEnvelopeAttackSurfaceAssetsList
  - `result` AttackSurfaceAssetsList
    - `assets` AttackSurfaceAsset[], nullable, required: The assets on this page.
      - `asset` string, required: The asset, as an IP address, CIDR block, ASN, domain, or certificate SHA-256 fingerprint, in the form you would send to add it. Assets of the types web_property, registrant_organization, registrant_email, crunchbase_organization, and organization are shown by their name or identifier and cannot be named in a request.
      - `type` 'organization' | 'host' | 'domain' | 'certificate' | 'web_property' | 'netblock' | 'autonomous_system' | 'registrant_organization' | 'registrant_email' | 'crunchbase_organization': The kind of entity the asset names. Only host, domain, certificate, netblock, and autonomous_system assets can be named in a request. Omitted when it cannot be determined.
    - `next_page_token` string: A token to pass as page_token to retrieve the next page. Omitted on the last page.

## Other responses

- `400`: Invalid page token
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Attack surface not found
- `409`: The Exposure Management API is not enabled, or the operation conflicts with the attack surface's current state.
- `422`: Invalid inputs
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v1/attacksurfaces/:attack_surface_id/excludes/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)