# Find all Blacklist entries `GET /v2/blacklist` Core API v2, Customer Blacklist. Retrieve a paginated list of Customer Blacklist entries **Authentication:** Send `Authorization: Bearer `. To authenticate, generate a Secret API Key from your ODUS Dashboard and include it in the `Authorization` header as follows: `Authorization: Bearer ` ## Parameters ### Query parameters - `id` (filter): Send as `id[]=`. Operators: `eq`, `ne`, `in`, `nin`. - `createdAt` (filter): Send as `createdAt[]=`. Operators: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`, `in`, `nin`. - `updatedAt` (filter): Send as `updatedAt[]=`. Operators: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`, `in`, `nin`. - `email` (filter): Send as `email[]=`. Operators: `eq`, `ne`, `like`, `ilike`, `in`, `nin`. - `reason` (filter): Send as `reason[]=`. Operators: `eq`, `ne`, `like`, `ilike`, `in`, `nin`. - `sortDirection` (string): Sort direction. Defaults to ASC. One of `ASC`, `DESC`, `asc`, `desc`. - `sortBy` (string): Field to sort by. Defaults to createdAt. One of `id`, `createdAt`, `updatedAt`, `email`. - `limit` (number): Number of items per page. Defaults to 10, capped at 100. Send 0 to return no items, which is how you ask for "withTotal"'s count without fetching a page you do not need. - `cursor` (string): Opaque cursor from a previous response ("nextCursor" or "prevCursor"). Send it back with the same "sortBy" and "sortDirection" — the cursor encodes them and a request that disagrees is rejected. "limit" may change between pages and simply changes the page size. Omit "cursor" for the first page. - `withTotal` (boolean): Set to true to also return how many items match the filters, as "totalCount" in the response's pagination. The count ignores "cursor", so it does not change as you page — fetch it once per set of filters rather than on every page. Counting stops at 10000, above which "totalCountIsExact" is false. Omit this parameter to skip the count entirely. ## Responses ### `200` OK Type: object. - `pagination` (object (CursorPageMetaDTO)) - `mode` (string, required): Discriminator identifying cursor-based pagination metadata. One of `cursor`. Default `cursor`. Example: `cursor`. - `pageSize` (number, required): Number of items per page. Minimum 0. Example: `10`. - `hasNextPage` (boolean, required): Whether a next page exists. Example: `false`. - `hasPreviousPage` (boolean, required): Whether a previous page exists. Example: `true`. - `nextCursor` (string, required, nullable): Opaque cursor for fetching the next page. Null when there is no next page. Example: `eyJzIjoiY3JlYXRlZEF0IiwiZCI6ImFzYyIsIm4iOiJmb3J3YXJkIn0`. - `prevCursor` (string, required, nullable): Opaque cursor for fetching the previous page. Null when there is no previous page. Example: `eyJzIjoiY3JlYXRlZEF0IiwiZCI6ImFzYyIsIm4iOiJiYWNrd2FyZCJ9`. - `totalCount` (number): Number of items matching this request's filters, ignoring the cursor. Present only when the request sets "withTotal". Counting stops at 10000; read "totalCountIsExact" before showing this as a total. Example: `139`. - `totalCountIsExact` (boolean): Whether "totalCount" is the exact number of matching items. False when more items match than counting reaches, in which case "totalCount" holds that limit and should be shown as a lower bound, for example "over 10,000". Present only when the request sets "withTotal". Example: `true`. - `data` (array of object (CustomerBlacklistDTO)) - `createdAt` (string (date-time), required): The date and time when the entity was created. Example: `2024-02-18T12:00:00Z`. - `updatedAt` (string (date-time), required, nullable): The date and time when the entity was last updated. Example: `2024-02-21T12:15:00Z`. - `metadata` (map of string to string, nullable): Metadata used by merchants to store additional information about the entity. - `id` (string, required): The unique identifier of the customer blacklist entry. - `email` (string, required): Email address of the blacklisted customer. Example: `user@example.com`. - `reason` (string, required, nullable): Reason for blacklisting this customer. Example: `Fraudulent activity detected`. ### `202` The merchant is entitled but its environment is not provisioned yet. Provisioning has been kicked off (exactly once) and is in progress; retry the request — it succeeds once the environment is ready. Returned only for identity-token (dashboard) requests bound to a merchant, not for secret-key API calls; any such endpoint can return it while provisioning is underway. Type: object (ProvisioningInProgress). - `status` (string, required): Signals the merchant environment is still being provisioned. One of `provisioning`. - `merchantAccountId` (string, required): The merchant account whose environment is being provisioned. Example: `dAI3aa87ROOeupeBCjNSKCOBOisBCYjB`. ### Errors - `400`: The request was rejected. `type` is `invalid_request_error` when the request itself is at fault — `errors` then lists every problem found, with field-attributable entries prefixed by the field’s path; or `invalid_state_error` when the request was well-formed but the resource is not in a state that allows it. - `401`: No API key was supplied, or the key is not valid. `type` is `authentication_error`. - `403`: The API key is valid but lacks the permission this operation requires. `type` is `permission_error`. - `429`: Too many requests. A limit applies per operation; requests to other operations are unaffected. `type` is `rate_limit_error`. Use the `Retry-After-global` header to know when to retry. - `500`: The request could not be completed because of an unexpected error. `type` is `api_error`. - `503`: The request could not be served right now: the API is temporarily at capacity, or a dependency needed to authorize the request is unavailable — the auth service that verifies credentials, or the entitlement lookup behind it. `type` is `api_error`. It is raised before the operation runs, so the request had no effect, and unlike a plain 500 the condition is transient: retry with backoff. - `504`: The request exceeded the processing time limit and was abandoned. `type` is `api_error` and `code` is `timeout` — unlike a plain 500 the request may still have taken effect, so retry with the same idempotency key rather than blindly. Every error response has the same body: see [Errors](https://docs.odus.com/docs/guides/api-features/errors.md). --- Generated from the Core API v2 OpenAPI document, https://api.odus.com/openapi.v2.json. Interactive page: https://docs.odus.com/docs/api/core/v2/blacklist-controller-find-all-paginated