Sign in

v1

latestOpenAPI 3.0.0Proprietary2026-07-244990150.4 KB
Blocklists

Create Blocklist

Create a new blocklist in the specified workspace. The blocklist is defined by a GNQL query and will automatically refresh its IP list.

post/v3/workspaces/{workspace_id}/blocklists

Path parameters

workspace_idstring uuid required

Workspace UUID.

Request body

querystring required

GNQL query that defines the blocklist.

namestring

Human-readable name for the blocklist.

ip_limitinteger nullable

Maximum number of IPs to return. Must be greater than 0 when provided.

enabledboolean

Whether the blocklist should be active. Defaults to true if omitted.

query_workspace_idstring uuid

Workspace whose data the query runs against. Requires the GNQL Diff entitlement.

Example request

{
  "query": "classification:malicious last_seen:1d",
  "name": "Malicious scanners",
  "ip_limit": 1000
}

Response

Created - blocklist successfully created.

idstring uuid

Blocklist ID.

workspace_idstring uuid

Owning workspace ID.

querystring

GNQL query that defines the blocklist.

query_hashstring

Hash of the GNQL query.

namestring nullable

Human-readable name for the blocklist.

ip_limitinteger nullable

Maximum number of IPs the blocklist will return.

entitlement_levelstring

The entitlement level used when the blocklist was created.

enabledboolean

Whether the blocklist is active.

last_ip_countinteger

Number of IPs returned on last refresh.

query_workspace_idstring uuid

Workspace whose data the query runs against, when different from the owning workspace.

tokenstring

Opaque token for unauthenticated blocklist access. Returned on list, create, and single-get operations.

created_atstring date-time

Creation timestamp.

updated_atstring date-time

Last update timestamp.

Example response

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "workspace_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "query": "classification:malicious last_seen:1d",
  "name": "Malicious scanners",
  "ip_limit": 1000,
  "enabled": true,
  "last_ip_count": 427
}