diff --git a/core/api/module-lib-current.txt b/core/api/module-lib-current.txt
index 5dc1cd7a31739..dd9582fddd4a2 100644
--- a/core/api/module-lib-current.txt
+++ b/core/api/module-lib-current.txt
@@ -189,6 +189,10 @@ package android.net {
     field public static final int TRANSPORT_TEST = 7; // 0x7
   }
 
+  public class NetworkWatchlistManager {
+    method @Nullable public byte[] getWatchlistConfigHash();
+  }
+
   public final class Proxy {
     method public static void setHttpProxyConfiguration(@Nullable android.net.ProxyInfo);
   }
diff --git a/core/java/android/net/NetworkWatchlistManager.java b/core/java/android/net/NetworkWatchlistManager.java
index 49047d3a0c873..8f6510ed3ea57 100644
--- a/core/java/android/net/NetworkWatchlistManager.java
+++ b/core/java/android/net/NetworkWatchlistManager.java
@@ -16,6 +16,8 @@
 
 package android.net;
 
+import android.annotation.Nullable;
+import android.annotation.SystemApi;
 import android.annotation.SystemService;
 import android.content.Context;
 import android.os.RemoteException;
@@ -29,6 +31,7 @@ import com.android.internal.util.Preconditions;
  * Class that manage network watchlist in system.
  * @hide
  */
+@SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
 @SystemService(Context.NETWORK_WATCHLIST_SERVICE)
 public class NetworkWatchlistManager {
 
@@ -90,6 +93,7 @@ public class NetworkWatchlistManager {
     /**
      * Get Network Watchlist config file hash.
      */
+    @Nullable
     public byte[] getWatchlistConfigHash() {
         try {
             return mNetworkWatchlistManager.getWatchlistConfigHash();