---
title: "Create an exclusion list item"
method: POST
path: "/exclusions/{organization}"
tags: ["Exclusions"]
---

# Create an exclusion list item

`POST /exclusions/{organization}`

## Request

- Base URL: `https://api.recordedfuture.com/collective-insights`
- URL: `https://api.recordedfuture.com/collective-insights/exclusions/{organization}`
- Auth: OAuth 2
  - Authorization code: `https://id.recordedfuture.com/authorize`
  - Token URL: `https://id.recordedfuture.com/token`

Creates a new exclusion list item for the specified organization.

## Path parameters

- `organization` string, required

## Request body

- CreateExclusionItemRequest
  - `comment` string, required
  - `type` 'observable' | 'ip_range' | 'device_name', required
  - `value` string, required

## Response `200`

Created exclusion item

- ExclusionActionResponse
  - `action` 'created' | 'updated' | 'deleted'
  - `id` string, uuid: Present for delete responses
  - `item` ExclusionItem
    - `comment` string: Optional comment
    - `created` string, date-time: Creation timestamp
    - `id` string, uuid: Exclusion item ID
    - `last_changed` string, date-time: Last modification timestamp
    - `owner` string: User identity that created the item
    - `type` 'observable' | 'ip_range' | 'device_name': Exclusion type
    - `value` string: Value to exclude (observable ID, CIDR, or device name)

## Other responses

- `400`: Client error
- `401`: Client error
- `403`: Client error
- `500`: Server error
- `503`: Server error

---

[API](https://skmtc.dev/recordedfuture/apis/collective-insights-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/collective-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/collective-insights-api/revisions/260c9863a7cf?raw)