---
title: "Create Code Scan Exclusion"
method: POST
path: "/v1/projects/{project_id}/code-scan/exclusions"
tags: ["code-scan"]
---

# Create Code Scan Exclusion

`POST /v1/projects/{project_id}/code-scan/exclusions`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/projects/{project_id}/code-scan/exclusions`
- Auth: none declared

Add an exclusion rule (Developer+, same gate as code-scan ingest).

IDEMPOTENT: a re-POST of the same `(type, value)` returns the EXISTING rule
with a 200 — never a duplicate, never a 409. Persistent: the rule survives
re-scans because it matches by value/path, not by fingerprint.

## Path parameters

- `project_id` string, required

## Request body

- CodeScanExclusionIn
  - `type` 'string' | 'file' | 'folder', required: Granularity: `string` matches `finding.string == value` · `file` matches `finding.file == value` · `folder` matches `finding.file` under `value + '/'`.
  - `value` string, required: Exact value/path (repo-relative POSIX). A `folder` prefix is normalised WITHOUT a trailing slash, so `src/ui` and `src/ui/` are the same rule.
  - `note` string, nullable: Optional free-text reason shown in the management view.

## Response `200`

Successful Response

- CodeScanExclusionOut
  - `uuid` string, required
  - `type` string, required
  - `value` string, required
  - `note` string, nullable
  - `created_at` string, date-time, required
  - `created_by` CodeScanRunActor: Display-ready attribution — the dashboard renders the `label`, never the raw `uuid` (which stays for an audit join). `label` is a human name resolved at BOUNDED per-page cost (a user's name/email, or a key's `name · prefix…last4`). A uuid that no longer resolves keeps its `type`/`uuid` and gets an explicit label (`unknown user` / `revoked or deleted key`) rather than vanishing — the attribution stays true, only the human name is gone.
    - `type` string, required: `user` or `api_key`.
    - `uuid` string, required
    - `label` string, nullable
  - `matched_count` integer, required: Findings this ONE rule masks right now, ALL statuses. Rules can overlap, so the sum across rules is not the project total — that is `summary.excluded`.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)