Change a list

PATCH/api/v1/ip/lists/{listId}

authentication: Secret API key as a bearer token
billing: Free.

Renames a list, changes its kind, or replaces its entries with the ones sent. Send only the fields you are changing; a body that names none of name, kind and entries answers 422 rather than quietly changing nothing, because that is the shape a misspelled field name takes. Entries are canonicalised and deduplicated exactly as on creation, and the change applies from the account's next lookup. A list that belongs to another account answers 404.

Parameters

name	in	type	description
listIdrequired	path	integer	The list's id from the index.

Request body

field	type	description
name	string	At most 100 characters.
kind	string	One of: allow, deny.
entries	string[]	Replaces the list's entries.

Example request

curl -X PATCH https://spaw.co/api/v1/ip/lists/7 \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Office and warehouse egress",
  "entries": [
    "203.0.113.0/24",
    "2001:db8:10::/48",
    "198.51.100.7"
  ]
}'

const response = await fetch('https://spaw.co/api/v1/ip/lists/7', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer sk_live_…',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Office and warehouse egress",
    "entries": [
      "203.0.113.0/24",
      "2001:db8:10::/48",
      "198.51.100.7"
    ]
  }),
});
const result = await response.json();

import requests

response = requests.patch(
    'https://spaw.co/api/v1/ip/lists/7',
    headers={'Authorization': 'Bearer sk_live_…'},
    json={
        'name': 'Office and warehouse egress',
        'entries': [
            '203.0.113.0/24',
            '2001:db8:10::/48',
            '198.51.100.7'
        ]
    },
)
result = response.json()

$ch = curl_init('https://spaw.co/api/v1/ip/lists/7');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer sk_live_…', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode([
        'name' => 'Office and warehouse egress',
        'entries' => [
            '203.0.113.0/24',
            '2001:db8:10::/48',
            '198.51.100.7'
        ]
    ]),
]);
$result = json_decode(curl_exec($ch), true);

from spaw import Client

client = Client('sk_live_…')
result = client.update_ip_list(7, name='Office and warehouse egress', entries=[
    '203.0.113.0/24',
    '2001:db8:10::/48',
    '198.51.100.7'
])

import Spaw from 'spaw';

const spaw = new Spaw({ apiKey: 'sk_live_…' });
const result = await spaw.updateIpList(7, {
    name: 'Office and warehouse egress',
    entries: [
        '203.0.113.0/24',
        '2001:db8:10::/48',
        '198.51.100.7'
    ]
});

use Spaw\Client;

$spaw = new Client('sk_live_…');
$result = $spaw->updateIpList(7, [
    'name' => 'Office and warehouse egress',
    'entries' => [
        '203.0.113.0/24',
        '2001:db8:10::/48',
        '198.51.100.7'
    ]
]);

This endpoint has no console on its page. It writes to your account. A documentation page can show you the request; making the change is for the dashboard or for a call you make yourself.

Responses

200The list as it now stands.

{
    "success": true,
    "data": {
        "list": {
            "id": 7,
            "name": "Office and warehouse egress",
            "kind": "allow",
            "entry_count": 3,
            "created_at": "2026-09-12T09:00:00+00:00",
            "updated_at": "2026-09-12T11:30:00+00:00",
            "entries": [
                "203.0.113.0/24",
                "2001:db8:10::/48",
                "198.51.100.7"
            ]
        }
    }
}

401The key is missing, malformed, or revoked.

{
    "success": false,
    "error": {
        "code": "UNAUTHENTICATED",
        "message": "Provide a valid API key as a bearer token.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

404No such record on this account.

{
    "success": false,
    "error": {
        "code": "NOT_FOUND",
        "message": "No record with that id on this account.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

422The request body could not be validated; `error.errors` lists the fields.

{
    "success": false,
    "error": {
        "code": "VALIDATION_FAILED",
        "message": "The email field is required.",
        "errors": {
            "email": [
                "The email field is required."
            ]
        },
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

429Over 5 requests per second for the key. Retry after the limit resets.

{
    "success": false,
    "error": {
        "code": "RATE_LIMITED",
        "message": "Too many requests. Retry after the limit resets.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

Error codes

Failures answer { success: false, error: { code, message, request_id } }. Each code has its own page.

markdown version·openapi.json