---
title: "Create blocked spam source"
method: POST
path: "/v3/blocked_spam_sources"
tags: ["Blocked Spam Sources"]
---

# Create blocked spam source

`POST /v3/blocked_spam_sources`

Adds a new IP address, CIDR range, email address, or email domain to the organization's spam blocklist. Once added, future applications arriving from a matching source are auto-rejected at intake; the entry does not retroactively reject existing applications. The combination of `source_type` and `value` must be unique within the organization, IP and CIDR values must be well-formed, and a small set of common consumer email domains is protected from being blocked.

## Request body

- object
  - `source_type` 'ip_address' | 'cidr_block' | 'email_address' | 'email_domain', required — Kind of identifier `value` represents. `ip_address` accepts a single IPv4 or IPv6 address; `cidr_block` accepts an IPv4 or IPv6 CIDR range (very large subnets — IPv4 prefix `<= 8` or IPv6 prefix `<= 32` — are rejected); `email_address` accepts a full address; `email_domain` accepts a domain (the part after `@`). Picking the wrong kind for the supplied `value` returns 422.
  - `value` string, required — The IP, CIDR range, email address, or domain to block, matching the chosen `source_type`. The value is normalized (stripped and lowercased) before being stored, and must be unique per `source_type` within the organization. Common consumer email domains (`gmail.com`, `outlook.com`, `hotmail.com`, `hotmail.co.uk`, `icloud.com`, `yahoo.com`, `live.com`, `aol.com`, `protonmail.com`) cannot be blocked and return 422.
  - `note` string — Optional free-text annotation, typically used to record why the source was added (e.g. ticket id, internal incident reference). Limited to 255 characters.

## Response `201`

Successful

- object
  - `id` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `source_type` 'ip_address' | 'cidr_block' | 'email_address' | 'email_domain' — Kind of identifier stored in `value`. `ip_address` is a single IPv4 or IPv6 address, `cidr_block` is an IPv4 or IPv6 CIDR range, `email_address` is a full address, and `email_domain` is the part after the `@`. Applications arriving from a matching source are rejected at intake with the reason `Rejected by organization blocklist`.
  - `value` string — The IP address, CIDR range, email address, or email domain to block, interpreted according to `source_type`. Stored lowercased and stripped of surrounding whitespace, so filtering by `value` is case-insensitive. Common consumer email domains (e.g. `gmail.com`, `outlook.com`, `yahoo.com`) cannot be blocked and are rejected on create.
  - `note` string, nullable — Free-text annotation set by the user who added or last updated the entry, typically used to record why the source was blocked. Limited to 255 characters; `null` when no note was provided.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `422` — Unprocessable Content

---

[API](https://skmtc.net/greenhouse/apis/auth-api.md) · [All operations](https://skmtc.net/greenhouse/apis/auth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greenhouse/auth-api/versions/9517a2e54640/schema)