Create an allow or deny list

POST/api/v1/ip/lists

authentication: Secret API key as a bearer token
billing: Free.

Saves a list of addresses and prefixes the account's lookups should treat as known-good (allow) or known-bad (deny): office and partner egress, a scraper's ranges, a fraud ring's space. Entries are IPv4 or IPv6 addresses or CIDR prefixes, canonicalised (an IPv4-mapped address collapses to dotted quad, 8.8.8.9/24 to 8.8.8.0/24) and deduplicated before validation; a start-end range or a hostname is refused with 422. The list applies from the account's next lookup.

An account may hold meta.max_lists lists (20) of meta.max_entries entries (5,000) each; the twenty-first answers 409 IP_LIST_LIMIT_REACHED. Answers 201 with the list and its entries.

Request body

field	type	description
namerequired	string	A label, answered back in `account_list.name` on every lookup the list matches. At most 100 characters.
kindrequired	string	`allow` zeroes the score of a matching address; `deny` adds the denylisted weight of 100. One of: allow, deny.
entriesrequired	string[]	1 to 5,000 IPv4 or IPv6 addresses or CIDR prefixes; duplicates and alternative spellings count once.

Example request

curl -X POST https://spaw.co/api/v1/ip/lists \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Office egress",
  "kind": "allow",
  "entries": [
    "203.0.113.0/24",
    "2001:db8:10::/48"
  ]
}'

const response = await fetch('https://spaw.co/api/v1/ip/lists', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_live_…',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Office egress",
    "kind": "allow",
    "entries": [
      "203.0.113.0/24",
      "2001:db8:10::/48"
    ]
  }),
});
const result = await response.json();

import requests

response = requests.post(
    'https://spaw.co/api/v1/ip/lists',
    headers={'Authorization': 'Bearer sk_live_…'},
    json={
        'name': 'Office egress',
        'kind': 'allow',
        'entries': [
            '203.0.113.0/24',
            '2001:db8:10::/48'
        ]
    },
)
result = response.json()

$ch = curl_init('https://spaw.co/api/v1/ip/lists');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer sk_live_…', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'name' => 'Office egress',
        'kind' => 'allow',
        'entries' => [
            '203.0.113.0/24',
            '2001:db8:10::/48'
        ]
    ]),
]);
$result = json_decode(curl_exec($ch), true);

from spaw import Client

client = Client('sk_live_…')
result = client.create_ip_list('Office egress', 'allow', [
    '203.0.113.0/24',
    '2001:db8:10::/48'
])

import Spaw from 'spaw';

const spaw = new Spaw({ apiKey: 'sk_live_…' });
const result = await spaw.createIpList('Office egress', 'allow', [
    '203.0.113.0/24',
    '2001:db8:10::/48'
]);

use Spaw\Client;

$spaw = new Client('sk_live_…');
$result = $spaw->createIpList('Office egress', 'allow', [
    '203.0.113.0/24',
    '2001:db8:10::/48'
]);

This endpoint has no console on its page. It writes to your account. A documentation page can show you the request; making the change is for the dashboard or for a call you make yourself.

Responses

201The list was saved and applies from the next lookup.

{
    "success": true,
    "data": {
        "list": {
            "id": 7,
            "name": "Office egress",
            "kind": "allow",
            "entry_count": 2,
            "created_at": "2026-09-12T09:00:00+00:00",
            "updated_at": "2026-09-12T09:00:00+00:00",
            "entries": [
                "203.0.113.0/24",
                "2001:db8:10::/48"
            ]
        }
    }
}

401The key is missing, malformed, or revoked.

{
    "success": false,
    "error": {
        "code": "UNAUTHENTICATED",
        "message": "Provide a valid API key as a bearer token.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

409The account already holds as many lists as it may (`IP_LIST_LIMIT_REACHED`). Nothing was created.

{
    "success": false,
    "error": {
        "code": "IP_LIST_LIMIT_REACHED",
        "message": "This account already holds 20 IP lists. Remove one, or add the entries to a list you have.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

422The request body could not be validated; `error.errors` lists the fields.

{
    "success": false,
    "error": {
        "code": "VALIDATION_FAILED",
        "message": "The email field is required.",
        "errors": {
            "email": [
                "The email field is required."
            ]
        },
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

429Over 5 requests per second for the key. Retry after the limit resets.

{
    "success": false,
    "error": {
        "code": "RATE_LIMITED",
        "message": "Too many requests. Retry after the limit resets.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

Error codes

Failures answer { success: false, error: { code, message, request_id } }. Each code has its own page.

markdown version·openapi.json