---
title: "List Code Scan Exclusions"
method: GET
path: "/v1/projects/{project_id}/code-scan/exclusions"
tags: ["code-scan"]
---

# List Code Scan Exclusions

`GET /v1/projects/{project_id}/code-scan/exclusions`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/projects/{project_id}/code-scan/exclusions`
- Auth: none declared

Every exclusion rule on the project, oldest first (Viewer+).

Each rule carries its live `matched_count` (findings it masks now, all
statuses) and a resolved `created_by`. This is the management view's source;
to see the findings a rule hides, call `/findings?excluded=only`.

## Path parameters

- `project_id` string, required

## Response `200`

Successful Response

- CodeScanExclusionOut[]
  - `uuid` string, required
  - `type` string, required
  - `value` string, required
  - `note` string, nullable
  - `created_at` string, date-time, required
  - `created_by` CodeScanRunActor: Display-ready attribution — the dashboard renders the `label`, never the raw `uuid` (which stays for an audit join). `label` is a human name resolved at BOUNDED per-page cost (a user's name/email, or a key's `name · prefix…last4`). A uuid that no longer resolves keeps its `type`/`uuid` and gets an explicit label (`unknown user` / `revoked or deleted key`) rather than vanishing — the attribution stays true, only the human name is gone.
    - `type` string, required: `user` or `api_key`.
    - `uuid` string, required
    - `label` string, nullable
  - `matched_count` integer, required: Findings this ONE rule masks right now, ALL statuses. Rules can overlap, so the sum across rules is not the project total — that is `summary.excluded`.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)