curl --request POST \
--url https://api.extole.io/v2/blocks \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"filter_type": "BLACK",
"list_type": "CIDR",
"value": "value"
}
'import requests
url = "https://api.extole.io/v2/blocks"
payload = {
"filter_type": "BLACK",
"list_type": "CIDR",
"value": "value"
}
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({filter_type: 'BLACK', list_type: 'CIDR', value: 'value'})
};
fetch('https://api.extole.io/v2/blocks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.extole.io/v2/blocks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'filter_type' => 'BLACK',
'list_type' => 'CIDR',
'value' => 'value'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.extole.io/v2/blocks"
payload := strings.NewReader("{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.extole.io/v2/blocks")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.extole.io/v2/blocks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}"
response = http.request(request)
puts response.read_body{
"block_id": "<string>",
"client_id": "<string>",
"created_date": "2025-10-24T02:00:00-07:00",
"filter_type": "BLACK",
"list_type": "CIDR",
"source": "<string>",
"user_id": "<string>",
"value": "<string>"
}Create a fraud-control rule
Creates a fraud-control rule for the client. The API calls a fraud-control rule a block. Each fraud-control rule puts a list_type (CIDR, user agent, email domain, or normalized email) and value on the permitted (filter_type WHITE) or blocked (filter_type BLACK) events list.
curl --request POST \
--url https://api.extole.io/v2/blocks \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"filter_type": "BLACK",
"list_type": "CIDR",
"value": "value"
}
'import requests
url = "https://api.extole.io/v2/blocks"
payload = {
"filter_type": "BLACK",
"list_type": "CIDR",
"value": "value"
}
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({filter_type: 'BLACK', list_type: 'CIDR', value: 'value'})
};
fetch('https://api.extole.io/v2/blocks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.extole.io/v2/blocks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'filter_type' => 'BLACK',
'list_type' => 'CIDR',
'value' => 'value'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.extole.io/v2/blocks"
payload := strings.NewReader("{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.extole.io/v2/blocks")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.extole.io/v2/blocks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"filter_type\": \"BLACK\",\n \"list_type\": \"CIDR\",\n \"value\": \"value\"\n}"
response = http.request(request)
puts response.read_body{
"block_id": "<string>",
"client_id": "<string>",
"created_date": "2025-10-24T02:00:00-07:00",
"filter_type": "BLACK",
"list_type": "CIDR",
"source": "<string>",
"user_id": "<string>",
"value": "<string>"
}Authorizations
Body
Body of a POST /v2/blocks request.
Which events list the fraud-control rule belongs to. WHITE is the permitted events list. BLACK is the blocked events list. A BLACK match changes an event only where something checks it: quality rules, prehandler actions, and campaign expressions that check fraud-control rules. Each check takes one value and one list type. The client's fraud-control rules are checked before Extole's global fraud-control rules, WHITE before BLACK within each, and the first fraud-control rule that matches that value wins. So when a client WHITE fraud-control rule and a global BLACK fraud-control rule both match the value, the WHITE one wins, and when a client BLACK fraud-control rule and a global WHITE fraud-control rule both match it, the BLACK one wins.
BLACK, WHITE What the fraud-control rule matches. USER_AGENT matches a substring of the event user-agent header (regex is not supported). EMAIL_DOMAIN matches the profile email domain on the event (for example example.com). NORMALIZED_EMAIL matches the provider-normalized profile email. Whether plus-address variants of the same mailbox match depends on the email provider. CIDR matches the event IP with CIDR notation (for example 192.168.1.0/24); overlapping CIDRs are separate fraud-control rules, not duplicates.
CIDR, EMAIL_DOMAIN, NORMALIZED_EMAIL, USER_AGENT Value to match for the chosen list_type. For CIDR, use CIDR notation such as 203.0.113.0/24. The value is stored lowercased, and a NORMALIZED_EMAIL value is stored provider-normalized. Creating a fraud-control rule whose filter type, list type, and stored value match an existing fraud-control rule returns block_duplicate, even when the submitted text differs.
Response
Successful response
A fraud-control rule on a permitted or blocked events list.
Server-assigned identifier of the fraud-control rule.
Client that owns the fraud-control rule, when it is client-scoped.
RFC 3339 or RFC 9557 date-time with a numeric UTC offset and an optional IANA time-zone suffix in square brackets. Precision up to milliseconds.
^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?(Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])(\[[^\]]+\])?$"2025-10-24T02:00:00-07:00"
Which events list the fraud-control rule belongs to. WHITE is the permitted events list. BLACK is the blocked events list. A BLACK match changes an event only where something checks it: quality rules, prehandler actions, and campaign expressions that check fraud-control rules. Each check takes one value and one list type. The client's fraud-control rules are checked before Extole's global fraud-control rules, WHITE before BLACK within each, and the first fraud-control rule that matches that value wins. So when a client WHITE fraud-control rule and a global BLACK fraud-control rule both match the value, the WHITE one wins, and when a client BLACK fraud-control rule and a global WHITE fraud-control rule both match it, the BLACK one wins.
BLACK, WHITE What the fraud-control rule matches. USER_AGENT matches a substring of the event user-agent header (regex is not supported). EMAIL_DOMAIN matches the profile email domain on the event (for example example.com). NORMALIZED_EMAIL matches the provider-normalized profile email. Whether plus-address variants of the same mailbox match depends on the email provider. CIDR matches the event IP with CIDR notation (for example 192.168.1.0/24); overlapping CIDRs are separate fraud-control rules, not duplicates.
CIDR, EMAIL_DOMAIN, NORMALIZED_EMAIL, USER_AGENT Who created the fraud-control rule: Extole when Extole created it, user specified when a client user created it.
My Extole user who created the fraud-control rule, when known.
Matched value for the fraud-control rule's list_type.
Was this page helpful?