> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/exceptions-commands.md).
# Exceptions Commands
* [createException](#createexception)
* [getExceptionManagementSettings](#getexceptionmanagementsettings)
* [getGlobalExceptions](#getglobalexceptions)
* [getIssueExceptionRules](#getissueexceptionrules)
#### createException
***
Creates an issue exception based on the provided filter rule and justification.
Arguments
| Argument Name | Description | Required |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| name | The human-readable name for the exception. | Required |
| rule | A JSON-encoded string representing a filter rule (standard Cortex AND/OR format) defining which issues the exception applies to. Provide only the AND/OR tree. For example: "{"AND":\[{"SEARCH\_FIELD":"id","SEARCH\_TYPE":"EQ","SEARCH\_VALUE":"100"}]}". | Required |
| justification\_text | The free-text justification explaining why the exception is needed. | Required |
| justification\_category | The category of justification for the exception. Possible values are: Compensating Control, Planned Remediation, Risk Accepted, Vendor Dependency. | Required |
| expiration\_ts | The expiration date/time. Accepts relative ('30 days') or absolute ('2026-01-01T00:00:00Z') values. | Required |
| approver\_email | The designated approver's email. Required only when the tenant approval workflow is enabled; must match a configured approver. | Optional |
| external\_exception\_id | An optional external tracking ID for the exception. | Optional |
| approval\_justification | A free-text justification for the approval decision. | Optional |
Outputs
**Core.IssueException.ExceptionID** *number*
The unique identifier of the created issue exception.
#### getExceptionManagementSettings
***
Returns the issue exception approval settings and the list of configured approvers.
**Arguments**
There are no input arguments for this command.
Outputs
**Core.ExceptionManagementSettings.ApprovalRequired** *boolean*
Whether creating an issue exception requires an approver's decision.
**Core.ExceptionManagementSettings.DisableExceptionEmailApprovalFlow** *boolean*
Whether the email-based approval flow is disabled.
**Core.ExceptionManagementSettings.Approvers.Name** *string*
The display name of the approver.
**Core.ExceptionManagementSettings.Approvers.Email** *string*
The email address of the approver.
#### getGlobalExceptions
***
Returns the full global exceptions configuration applied across endpoints.
**Arguments**
There are no input arguments for this command.
Outputs
**Core.GlobalException.profile\_name** *string*
The name of the global exceptions profile.
**Core.GlobalException.usage\_count** *number*
The number of times the global exceptions profile is used.
**Core.GlobalException.description** *string*
The description of the global exceptions profile.
**Core.GlobalException.creation\_time** *number*
The creation timestamp of the global exceptions profile (epoch milliseconds).
**Core.GlobalException.created\_by** *string*
The user who created the global exceptions profile.
**Core.GlobalException.modification\_time** *number*
The last modification timestamp of the global exceptions profile (epoch milliseconds).
**Core.GlobalException.modules** *unknown*
The exception modules and their configured entries.
#### getIssueExceptionRules
***
Returns a list of issue exception rules based on the provided filter criteria.
Arguments
| Argument Name | Description | Required |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- |
| limit | The maximum number of exception rules to return. Ignored when 'page' or 'page\_size' is provided. Default is 50. | Optional |
| page\_size | The number of exception rules to return per page. When provided, manual pagination is used and 'limit' is ignored. | Optional |
| page | The page number to retrieve (0-based). When provided, manual pagination is used and 'limit' is ignored. | Optional |
| filter\_object | A JSON string representing a raw filter object. If provided, this overrides all other filter arguments. Cannot be used together with other filter arguments. | Optional |
Outputs
**Core.ExceptionRule.exception\_id** *number*
The unique identifier of the issue exception rule.
**Core.ExceptionRule.name** *string*
The name of the exception rule.
**Core.ExceptionRule.status** *string*
The status of the exception rule.
**Core.ExceptionRule.rule** *string*
The filter rule defining which issues the exception applies to.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/exceptions-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.