--- title: "GetExceptionRule" slug: "security-webshellbehaviordetector-exceptionrule-getexceptionrule" tags: ["Webshell Behavior Detector"] updated: 2026-09-17T10:15:45Z published: 2026-09-17T10:15:45Z canonical: "api.ncloud-docs.com/security-webshellbehaviordetector-exceptionrule-getexceptionrule" --- > ## Documentation Index > Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # GetExceptionRule Available in VPC Get the list of exception rules for webshell suspicious behavior. ## Request The following describes the request format for the endpoint. The request format is as follows: | Method | URI | | --- | --- | | GET | /api/v1/exception-rules | ### Request headers For information about the headers common to all Webshell Behavior Detector APIs, see [Webshell Behavior Detector request headers](/docs/en/security-webshellbehaviordetector#%EC%9A%94%EC%B2%AD%ED%97%A4%EB%8D%94). ### Request query parameters You can use the following query parameters with your request: | Field | Type | Required | Description | | --- | --- | --- | --- | | `pageIndex` | Integer | Required | Page number | | `pageSize` | Integer | Required | Number of page outputs | ### Request example The following is a sample request. ``` curl --location --request GET 'https://wbd.apigw.ntruss.com/api/v1/exception-rules?pageIndex=0&pageSize=2' \ --header 'x-ncp-apigw-timestamp: {Timestamp}' \ --header 'x-ncp-iam-access-key: {Access Key}' \ --header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \ --header 'Content-Type: application/json' \ --header 'X-NCP-USE_PLATFORM_TYPE: VPC' ``` ## Response The following describes the response format. ### Response body The following describes the response body. | Field | Type | Required | Description | | --- | --- | --- | --- | | `success` | Boolean | - | Request handling status | | `code` | Integer | - | Response code | | `message` | String | - | Response message | | `result` | Object | - | Response result | | `content` | Array | - | List of exception rule history: [content](/docs/en/security-webshellbehaviordetector-exceptionrule-getexceptionrule#content) | | `totalCount` | Integer | - | Number of response results | | `pageSize` | Integer | - | Number of page outputs | | `pageIndex` | Integer | - | Page number | | `totalPages` | Integer | - | Total number of pages | #### `content` The following describes `content`. | Field | Type | Required | Description | | --- | --- | --- | --- | | `disabled` | Boolean | - | Whether exception rule is disabled - Display for sub account - `true` \| `false` - `true`: disabled - `false`: enabled | | `actionName` | String | - | Action name of sub account - Display for sub account | | `permission` | Enum | - | Sub account permissions - Display for sub account - `Allow` \| `Deny` | | `exceptedRuleId` | String | - | Exception rule ID | | `exceptedRuleName` | String | - | Exception rule name | | `exceptTargetType` | String | - | Exception target type - `serverGroup` \| `everyServer` \| `server` - `serverGroup`: server group - `everyServer`: all servers - `server`: specific server | | `exceptTarget` | String | - | Instance ID of exception target | | `exceptTargetName` | String | - | Name of exception target | | `processName` | String | - | Process name to compare | | `processNameCondition` | String | - | Comparison condition of process name - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `processArg` | String | - | Process argument to compare | | `processArgCondition` | String | - | Comparison condition of process argument - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `executor` | String | - | Execution account to compare | | `executorCondition` | String | - | Comparison condition of execution account - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `processNameOfParent` | String | - | Name of parent process to compare | | `processNameOfParentCondition` | String | - | Comparison condition of parent process name - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `processArgOfParent` | String | - | Name of parent process argument to compare | | `processArgOfParentCondition` | String | - | Comparison condition of parent process argument - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `executorOfParent` | String | - | Execution account of the parent process to compare | | `executorOfParentCondition` | String | - | Comparison condition of parent process execution account - `EQUAL` \| `NOT_USE` \| `START` \| `END` - `EQUAL`: exact match - `NOT_USE`: comparision condition not used - `START`: start string match - `END`: end string match | | `createdTime` | Integer | - | Exception rule creation date and time - Timestamp format | | `deletedTime` | Integer | - | Exception rule deletion date and time - Timestamp format | | `isDeleted` | Boolean | - | Deletion status of exception rule - `true` \| `false` - `true`: deleted - `false`: not deleted | | `memo` | String | - | Notes | | `memberNo` | Integer | - | Member ID for VM usage | | `groupIsDeleted` | Boolean | - | Deletion status of server group - `true` \| `false` - `true`: deleted - `false`: not deleted | ### Response status codes For information about the HTTP status codes common to all Webshell Behavior Detector APIs, see [Webshell Behavior Detector response status codes](/docs/en/security-webshellbehaviordetector#%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C). ### Response example The following is a sample example. ``` { "success": true, "code": 0, "message": "success", "result": { "content": [ { "disabled": false, "actionName": null, "permission": null, "exceptedRuleId": "2024080714042400000006", "exceptedRuleName": "excep-rule-3", "exceptTargetType": "server", "exceptTarget": "{target-instance-id}", "exceptTargetName": "{target-name}", "processName": "{process}", "processNameCondition": "EQUAL", "processArg": "{process-and-arguments}", "processArgCondition": "EQUAL", "executor": "DefaultAppPool", "executorCondition": "EQUAL", "processNameOfParent": "{process}", "processNameOfParentCondition": "EQUAL", "processArgOfParent": "{process-and-arguments}", "processArgOfParentCondition": "EQUAL", "executorOfParent": "DefaultAppPool", "executorOfParentCondition": "EQUAL", "createdTime": 1723007064480, "deletedTime": null, "isDeleted": false, "memo": null, "memberNo": 26***90, "groupIsDeleted": null }, { "disabled": false, "actionName": null, "permission": null, "exceptedRuleId": "2024080714032700000004", "exceptedRuleName": "excep-rule-2", "exceptTargetType": "server", "exceptTarget": "{target-instance-id}", "exceptTargetName": "{target-name}", "processName": "{process}", "processNameCondition": "EQUAL", "processArg": "{process-and-arguments}", "processArgCondition": "EQUAL", "executor": "root", "executorCondition": "EQUAL", "processNameOfParent": "{process}", "processNameOfParentCondition": "EQUAL", "processArgOfParent": "{process-and-arguments}", "processArgOfParentCondition": "EQUAL", "executorOfParent": "root", "executorOfParentCondition": "EQUAL", "createdTime": 1723007007644, "deletedTime": null, "isDeleted": false, "memo": null, "memberNo": 26***90, "groupIsDeleted": null } ], "totalCount": 3, "pageSize": 2, "pageIndex": 0, "totalPages": 2 } } ```