---
title: "List blocked spam sources"
method: GET
path: "/v3/blocked_spam_sources"
tags: ["Blocked Spam Sources"]
---

# List blocked spam sources

`GET /v3/blocked_spam_sources`

## Request

- Base URL: `https://harvest.greenhouse.io`
- URL: `https://harvest.greenhouse.io/v3/blocked_spam_sources`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://auth.greenhouse.io/authorize`
    - Client credentials
    - Token URL: `https://auth.greenhouse.io/token` scopes: `harvest:blocked_spam_sources:list`
  - HTTP bearer

Lists the IP addresses, CIDR ranges, email addresses, and email domains the organization has blocked from submitting applications. Entries are managed under Configure > Real Talent > Spam in the Greenhouse UI and via this resource; applications arriving from a matching source are auto-rejected at intake with the reason `Rejected by organization blocklist`. Requires the Real Talent spam blocklist product flag to be enabled on the organization; without it the endpoint returns 403.

## Query parameters

- `cursor` string
- `per_page` integer
- `ids` integer[]
- `created_at` object
  - `gte` string, date-time
  - `lte` string, date-time
  - `gt` string, date-time
  - `lt` string, date-time
- `updated_at` object
  - `gte` string, date-time
  - `lte` string, date-time
  - `gt` string, date-time
  - `lt` string, date-time
- `fields` string[]
- `source_type` 'ip_address' | 'cidr_block' | 'email_address' | 'email_domain'
- `value` string

## Response `200`

Successful

- object[]
  - `id` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `source_type` 'ip_address' | 'cidr_block' | 'email_address' | 'email_domain': Kind of identifier stored in `value`. `ip_address` is a single IPv4 or IPv6 address, `cidr_block` is an IPv4 or IPv6 CIDR range, `email_address` is a full address, and `email_domain` is the part after the `@`. Applications arriving from a matching source are rejected at intake with the reason `Rejected by organization blocklist`.
  - `value` string: The IP address, CIDR range, email address, or email domain to block, interpreted according to `source_type`. Stored lowercased and stripped of surrounding whitespace, so filtering by `value` is case-insensitive. Common consumer email domains (e.g. `gmail.com`, `outlook.com`, `yahoo.com`) cannot be blocked and are rejected on create.
  - `note` string, nullable: Free-text annotation set by the user who added or last updated the entry, typically used to record why the source was blocked. Limited to 255 characters; `null` when no note was provided.

---

[API](https://skmtc.dev/greenhouse/apis/harvest-api.md) - [All operations](https://skmtc.dev/greenhouse/apis/harvest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/greenhouse/apis/harvest-api/revisions/822822e3f771?raw)