---
title: "Import an exception list"
method: POST
path: "/api/exception_lists/_import"
tags: ["Security Exceptions API"]
---

# Import an exception list

`POST /api/exception_lists/_import`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_import</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Import an exception list and its associated items from an NDJSON file.

## Query parameters

- `overwrite` boolean
- `as_new_list` boolean

## Response `200`

Successful response

- object
  - `errors` SecurityExceptionsAPIExceptionListsImportBulkError[], required
    - `error` object, required
      - `message` string, required
      - `status_code` integer, required
    - `id` string, nonempty — Exception list's identifier.
    - `item_id` string, nonempty — Human readable string identifier, e.g. `trusted-linux-processes`
    - `list_id` string, nonempty — The exception list's human-readable string identifier. For endpoint artifacts, use one of the following values: * `endpoint_list`: Elastic Endpoint exceptions list * `endpoint_trusted_apps`: Trusted applications list * `endpoint_trusted_devices`: Trusted devices list * `endpoint_event_filters`: Event filters list * `endpoint_host_isolation_exceptions`: Host isolation exceptions list * `endpoint_blocklists`: Blocklist
  - `success` boolean, required
  - `success_count` integer, required
  - `success_count_exception_list_items` integer, required
  - `success_count_exception_lists` integer, required
  - `success_exception_list_items` boolean, required
  - `success_exception_lists` boolean, required

## Other responses

- `400` — Invalid input data response
- `401` — Unsuccessful authentication response
- `403` — Not enough privileges response
- `500` — Internal server error response

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/d3fa2d005f9b/schema)