Remove a blocklist entry
The risk.blocklist.delete operation: DELETE /api/v1/risk/blocklist/{id} in the REST API and the risk_blocklist_delete tool in the MCP server.
/api/v1/risk/blocklist/{id}Removes a value from the brand's blocklist: payments that match it are no longer refused for it (other rules
still apply). Returns the removed entry. The audit log keeps what was removed and by whom. A customer whose risk
a rejected review set to blocked stays blocked: change that on the customer.
At a glance
- REST:
DELETE /api/v1/risk/blocklist/{id} - MCP tool:
risk_blocklist_delete - Operation ID:
risk.blocklist.delete - Scope: Brand
- Permission:
customers:write - Risk tier:
write - Dry run: Supported (send
Ownrecord-Dry-Run: true) - Idempotency:
Idempotency-Keyoptional - Modes: Test and live
- Authentication: API key with the
customers:writescope - Since: M9
Request
Path parameters
| Field | Type | Description |
|---|---|---|
id | rbl_… ID |
Body
This operation takes no body.
Response
200 OK with a JSON object:
| Field | Type | Description |
|---|---|---|
id | rbl_… ID | |
object | "risk_blocklist_entry" | |
livemode | boolean | |
brandId | brd_… ID | |
kind | one of email, card_fingerprint, ip_range, country | |
value | string | |
reason | string or null | |
source | one of operator, review | |
evaluationId | rsk_… ID or null | |
createdBy | string | |
createdAt | date-time |
Examples
Unblock an email
DELETE /api/v1/risk/blocklist/rbl_01m4ttwd3veh9apbewxheq5xr2
Authorization: Bearer or_test_…
Response (200):
{
"id": "rbl_01m4ttwd3veh9apbewxheq5xr2",
"object": "risk_blocklist_entry",
"livemode": true,
"brandId": "brd_01m4ttwd3veh9apbewxheq5xh5",
"kind": "email",
"value": "card.tester@example.com",
"reason": "Tried six cards in ten minutes",
"source": "operator",
"evaluationId": null,
"createdBy": "usr_01m4ttwd3veh9apbewxheq5xh6",
"createdAt": "2026-10-20T09:00:00.000Z"
}
Errors
| Code | HTTP status | When | What to do |
|---|---|---|---|
resource_not_found | 404 | No blocklist entry with this ID in this brand and mode. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
version_conflict | 409 | The entry changed at the same moment; retry. | Fetch the object again and retry the change. |
permission_denied | 403 | You can't change this brand's customers. | Ask an organization owner or admin for a role or scope that allows this action. |
It can also return these common errors: validation_failed, api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, scope_required, idempotency_key_reused, idempotency_in_progress, approval_required, approval_rejected, approval_expired, stale_approval, approval_policy_denied, rate_limited, internal_error.