List the account's allow and deny lists

GET/api/v1/ip/lists

authentication: Secret API key as a bearer token
billing: Free.

Every allow and deny list on the account, oldest first, without the entries. A list belongs to the account rather than to whoever created it: every member's lookups apply it and any member may change or remove it. meta carries the two limits, how many lists an account may hold and how many entries one list may carry.

The lists apply to every lookup the account is billed for — the API, the dashboard, batches, bulk runs, monitors and the browser widget. Deny lists are checked before allow lists, so a contradiction fails closed. A lookup that hits one carries account_list ({ id, name, kind, entry }): an allow-list hit answers risk_score: 0 with a single allowlisted signal of weight 0, a deny-list hit adds denylisted 100, and sources gains account-lists with the list's last change as its version.

Example request

curl https://spaw.co/api/v1/ip/lists \
  -H "Authorization: Bearer sk_live_…"

const response = await fetch('https://spaw.co/api/v1/ip/lists', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer sk_live_…',
  },
});
const result = await response.json();

import requests

response = requests.get(
    'https://spaw.co/api/v1/ip/lists',
    headers={'Authorization': 'Bearer sk_live_…'},
)
result = response.json()

$ch = curl_init('https://spaw.co/api/v1/ip/lists');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer sk_live_…'],
]);
$result = json_decode(curl_exec($ch), true);

from spaw import Client

client = Client('sk_live_…')
result = client.list_ip_lists()

import Spaw from 'spaw';

const spaw = new Spaw({ apiKey: 'sk_live_…' });
const result = await spaw.listIpLists();

use Spaw\Client;

$spaw = new Client('sk_live_…');
$result = $spaw->listIpLists();

This endpoint has no console on its page. It answers with records from your own account, often by an id only you have, rather than about a value you can type here. The dashboard lists the same rows.

Responses

200The account's lists.

{
    "success": true,
    "data": {
        "lists": [
            {
                "id": 7,
                "name": "Office egress",
                "kind": "allow",
                "entry_count": 2,
                "created_at": "2026-09-12T09:00:00+00:00",
                "updated_at": "2026-09-12T09:00:00+00:00"
            }
        ]
    },
    "meta": {
        "max_lists": 20,
        "max_entries": 5000
    }
}

401The key is missing, malformed, or revoked.

{
    "success": false,
    "error": {
        "code": "UNAUTHENTICATED",
        "message": "Provide a valid API key as a bearer token.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

429Over 5 requests per second for the key. Retry after the limit resets.

{
    "success": false,
    "error": {
        "code": "RATE_LIMITED",
        "message": "Too many requests. Retry after the limit resets.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

Error codes

Failures answer { success: false, error: { code, message, request_id } }. Each code has its own page.

markdown version·openapi.json