---
title: "Add or update workspace blocklist addresses"
method: PUT
path: "/v2/workspace_blocklist_addresses"
tags: ["Workspace blocklist"]
---

# Add or update workspace blocklist addresses

`PUT /v2/workspace_blocklist_addresses`

## Request

- Base URL: `https://api.attio.com`
- URL: `https://api.attio.com/v2/workspace_blocklist_addresses`
- Auth: OAuth 2
  - Authorization code: `https://app.attio.com/authorize`
  - Token URL: `https://app.attio.com/oauth/token` scopes: `email_calendar_blocklist:read-write`

An address is an email address (jane@acme.com) or a domain (acme.com).

Sets each address in the request to the given enforcement level on the workspace blocklist. The address itself is its key: there is no separate ID.

An address that isn't on the workspace blocklist is added. An address already at the requested level is left unchanged, so this endpoint is safe to retry. An address at the other level is moved to the requested level.

This endpoint only adds and updates the addresses in the request. Addresses on the workspace blocklist that aren't in the request are left alone; it never replaces the whole list.

Addresses are normalized: email addresses and domains are trimmed and lowercased, a URL is reduced to its hostname, and a leading `www.` is removed. The response returns the normalized value, which is the key for the address. Duplicate addresses are collapsed, and a request that gives the same address two different enforcement levels is rejected.

The request is applied all or nothing. Protected changes take effect immediately. Blocked changes take effect once each connected mailbox has re-synced, which may take a few minutes.

A user-level access token can only call this endpoint if the workspace member it acts for is a workspace admin.

This endpoint is in alpha and may be subject to breaking changes as we gather feedback.

Required scopes: `email_calendar_blocklist:read-write`.

Supported token levels: `workspace`, `user`.

## Request body

- object
  - `data` object, required
    - `addresses` object[], required: The addresses to set and the enforcement level each should have. A maximum of 500 addresses can be provided per request. The same address may not appear with two different enforcement levels.
      - `address` string, required: An email address or a domain. Attio works out which one it is. Email addresses are trimmed and lowercased, and their host must be a valid domain. Domains are trimmed and lowercased, a URL is reduced to its hostname, and a leading `www.` is removed; subdomains are kept. Single labels (`acme`), bare public suffixes (`com`), unknown suffixes, IP addresses, wildcards and values over 253 characters are rejected.
      - `enforcement_level` 'protected' | 'blocked', required: `protected`: emails and calendar events are hidden unless at least one participant is not on the workspace blocklist. `blocked`: they are hidden even when other participants are included.

## Response `200`

Success

- object: Success
  - `data` object[], required
    - `address` string, required: The normalized email address or domain. It is the address's key on the workspace blocklist.
    - `address_type` 'email_address' | 'domain', required: Whether the address is an email address or a domain.
    - `enforcement_level` 'protected' | 'blocked', required: `protected`: emails and calendar events are hidden unless at least one participant is not on the workspace blocklist. `blocked`: they are hidden even when other participants are included.
    - `created_at` string, date-time, required: When the address was given its current enforcement level.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict

## Changes

- **2026-11-02** `7d2c7472b378`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/attio/apis/attio-api/changes/v2/workspace_blocklist_addresses/put.md)

---

[API](https://skmtc.dev/attio/apis/attio-api.md) - [All operations](https://skmtc.dev/attio/apis/attio-api/llms.txt) - [OpenAPI document](https://skmtc.dev/attio/apis/attio-api/revisions/7d2c7472b378?raw)