Create blacklist value
Adds a blacklist entry that blocks a value at a given field_path, optionally with a ttl_seconds expiry. The path must resolve to a scalar and must not be pci-pan- or pci-sad-scoped — array- or object-typed and regulated paths reject with 422; blacklist cards by $.credential_fingerprint. Entries carry no schema binding, so the check is conservative across every registered schema and version.
Authorizations
HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication).
Body
Blacklist value
Response
Created value
"7d3b9f1e-4a6c-4c8d-b2e5-1f8a4c6e9d3b"
Human-readable hint, e.g. masked PAN for $.credential_fingerprint entries.
"411111 •••••• 4242"
When the entry expires. Null means it never expires.
"2026-09-01T00:00:00Z"
JSON path of the field, e.g. $.device.ip.
"$.device.ip"
"2026-06-01T10:00:05Z"
ID of the decision that triggered this entry.
"1e7b9c0a-2d43-4f6a-8d29-c4a1f2d05b3e"
"2026-06-01T10:00:05Z"
The blacklisted value for this field.
"1.2.3.4"
The x-data-classification that field_path resolves to across the registered schemas. A path no schema declares is any — an omitted marker is a positive assertion, and an entry on such a path is inert anyway, since undeclared keys never enter a decision payload.
any, pii "any"