---
title: "Update blocked spam source"
method: PATCH
path: "/v3/blocked_spam_sources/{id}"
tags: ["Blocked Spam Sources"]
---

# Update blocked spam source

`PATCH /v3/blocked_spam_sources/{id}`

## Request

- Base URL: `https://harvest.greenhouse.io`
- URL: `https://harvest.greenhouse.io/v3/blocked_spam_sources/{id}`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://auth.greenhouse.io/authorize`
    - Client credentials
    - Token URL: `https://auth.greenhouse.io/token` scopes: `harvest:blocked_spam_sources:update`
  - HTTP bearer

Updates the `note` on a blocked spam source. `source_type` and `value` are immutable on this endpoint — to change either, delete the entry and create a new one.

## Path parameters

- `id` integer, required

## Request body

- object
  - `note` string: Replacement annotation for the blocked spam source, typically used to record why the source was added or last touched (e.g. ticket id, internal incident reference). Limited to 255 characters. `source_type` and `value` are immutable — to change either, delete the entry and create a new one.

## Response `200`

Successful

- object
  - `id` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `source_type` 'ip_address' | 'cidr_block' | 'email_address' | 'email_domain': Kind of identifier stored in `value`. `ip_address` is a single IPv4 or IPv6 address, `cidr_block` is an IPv4 or IPv6 CIDR range, `email_address` is a full address, and `email_domain` is the part after the `@`. Applications arriving from a matching source are rejected at intake with the reason `Rejected by organization blocklist`.
  - `value` string: The IP address, CIDR range, email address, or email domain to block, interpreted according to `source_type`. Stored lowercased and stripped of surrounding whitespace, so filtering by `value` is case-insensitive. Common consumer email domains (e.g. `gmail.com`, `outlook.com`, `yahoo.com`) cannot be blocked and are rejected on create.
  - `note` string, nullable: Free-text annotation set by the user who added or last updated the entry, typically used to record why the source was blocked. Limited to 255 characters; `null` when no note was provided.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `422`: Unprocessable Content

---

[API](https://skmtc.dev/greenhouse/apis/harvest-api.md) - [All operations](https://skmtc.dev/greenhouse/apis/harvest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/greenhouse/apis/harvest-api/revisions/822822e3f771?raw)