---
title: "Create global exclusion"
method: POST
path: "/api/admin/exclusions"
tags: ["Admin"]
---

# Create global exclusion

`POST /api/admin/exclusions`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/admin/exclusions`
- Auth: API key in cookie `hk_token`

Creates an instance-level CIDR, country, user-agent, or path exclusion for all sites. Rules affect new traffic only. Requires instance.manage_site_exclusions.

## Request body

- IPExclusionCreateRequest
  - `cidr` string: IP or CIDR value for cidr rules. Plain IP values are normalized to /32 (IPv4) or /128 (IPv6).
  - `country_code` string: ISO 3166-1 alpha-2 country code for country rules. Values are normalized to uppercase.
  - `description` string
  - `path` string: Path rule. Query and fragment are removed; duplicate or trailing slashes and dot segments are normalized before case-sensitive segment-boundary matching.
  - `type` 'cidr' | 'country' | 'user_agent' | 'path': Rule type. Omitted cidr requests remain accepted for backward compatibility.
  - `user_agent` string: Case-insensitive substring for user_agent rules. Leading and trailing whitespace is removed.

## Response `201`

Created exclusion

- IPExclusion
  - `cidr` string: Normalized IP or CIDR value for cidr rules.
  - `country_code` string: Uppercase ISO 3166-1 alpha-2 country code for country rules.
  - `created_at` string, date-time, required
  - `created_by` string, uuid: Creator ID. Omitted from inherited rows returned across scopes.
  - `description` string
  - `id` string, uuid, required
  - `inherited` boolean, required: True when returned through a child scope's effective read.
  - `path` string: Normalized, query-free, case-sensitive path matched on segment boundaries.
  - `scope` 'instance' | 'team' | 'site': Scope that owns this rule.
  - `site_id` string, uuid: Owning site for site rules.
  - `team_id` string, uuid: Owning team for team rules.
  - `type` 'cidr' | 'country' | 'user_agent' | 'path', required
  - `user_agent` string: Case-insensitive user-agent substring for user_agent rules.

## Other responses

- `400`: Invalid exclusion rule

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)