Reference · Server API
/api/v1/blocklist
Reading and writing the blocklist from your own system.
Reading and writing the blocklist from your own system.
GET /api/v1/blocklist POST /api/v1/blocklist DELETE /api/v1/blocklist
Authentication#
The operator token, in the x-collect-token header. Not a site key: this acts on a scope wider than one site.
Writes must be application/json. That requirement is the CSRF defence. It forces a cross-site request into a preflight that no other origin passes.
Scopes#
The same three as on Security: visitor, address, hardware.
Before a wide entry is written, the system counts how many people it would refuse and refuses the value outright past a limit. A WebGL parameter hash is a graphics card plus a driver, a model of laptop, and nothing in 32 hex characters tells you which kind of value it is.
Entries belong to a workspace#
An entry carries a workspaceId and applies only to that workspace's sites. An entry with none is the platform operator's and applies everywhere.
Where it is applied#
Both /api/v1/collect and /api/v1/verdict. The order of checks is visitor, then hardware, then address.
Entries belong to the operator reason category, the only one that outranks every measurement, because a person decided.