---
title: "Check websites against the blacklist (S2S only)"
method: POST
path: "/v1/internal/blacklist/check"
tags: ["Internal Blacklist"]
---

# Check websites against the blacklist (S2S only)

`POST /v1/internal/blacklist/check`

## Request

- Base URL: `https://api.paymongo.com`
- URL: `https://api.paymongo.com/v1/internal/blacklist/check`
- Auth: HTTP bearer

Reports how the active blacklist classifies each website, and what creating a request with it would do. Read-only; creates nothing.

## Request body

- BlacklistCheckReqDTO
  - `websites` string[], required: Websites are checked individually. A single entry may itself be a comma-separated list, which is how merchants often submit several sites in one field.

## Response `200`

OK

- object: Standard response containing data and its metadata if any
  - `data` BlacklistCheckResDTO
    - `results` BlacklistCheckResultDTO[]
      - `category` string: Category is the list that fired: contains_keyword, exact_keyword, wildcard_pattern or exact_domain. Empty when nothing matched.
      - `class` string: Class is "invalid" (the merchant can fix it) or "prohibited" (a business we will not onboard). Empty when nothing matched.
      - `matched` boolean
      - `outcome` string: Outcome describes what creating a request with this website would do.
      - `pattern` string: Pattern is the blacklist entry that matched. Ops-only — this endpoint is S2S, and the value is deliberately never returned on any merchant-facing route.
      - `website` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/paymongo/apis/onboarding-api.md) - [All operations](https://skmtc.dev/paymongo/apis/onboarding-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/onboarding-api/revisions/36885f98768f?raw)