> ## Documentation Index > Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt > Use this file to discover all available pages before exploring further. # List blacklist rules > The store's blacklist, a page at a time. A buyer who matches a rule that is in force cannot start or pay for a checkout. A store holds up to 10,000 rules. Needs the `fraud.read` permission (Read Fraud Protection). ## OpenAPI ````yaml /api-reference/openapi.json get /stores/{storeId}/blacklist openapi: 3.1.0 info: title: Shoply API version: '1' description: >- Everything a store's own server can do with a secret API key: its catalogue, orders, customers, marketing, finance and the rest of what the dashboard does. And the Customer API, which a buyer's own device asks with a token of theirs. servers: - url: https://api.shoply.gg/v1 security: - apiKey: [] tags: - name: API key - name: Store - name: Domain - name: Payment methods - name: Analytics - name: Storefronts - name: Storefront code - name: Payment Routing - name: Custom payment methods - name: Products - name: Product pictures - name: Stock - name: Categories - name: Upsells - name: Subscriptions - name: Orders - name: Invoices - name: Reviews - name: Coupons - name: Coupon categories - name: Coupon pop-up - name: Sales - name: Blog - name: Search settings - name: Redirects - name: Sitemap - name: Cart Recovery - name: Email Marketing - name: Email Templates - name: Customers - name: Affiliates - name: Support Tickets - name: Blacklist - name: Fraud protection - name: Disputes - name: Finance - name: Tax - name: Expenses - name: Expense setup - name: API requests - name: Webhook endpoints - name: Webhook deliveries - name: Customer API paths: /stores/{storeId}/blacklist: get: tags: - Blacklist summary: List blacklist rules description: >- The store's blacklist, a page at a time. A buyer who matches a rule that is in force cannot start or pay for a checkout. A store holds up to 10,000 rules. Needs the `fraud.read` permission (Read Fraud Protection). operationId: blacklist.list parameters: - name: storeId in: path required: true description: >- The store's ID. A key reaches the store it was made in: `GET /key` answers which. schema: type: string - name: page in: query required: false description: Which page of the list. The first is 1. schema: type: integer default: 1 - name: perPage in: query required: false description: How many a page holds. schema: type: integer default: 20 - name: status in: query required: false description: Only rules that are in force, or only ones switched off. schema: type: string enum: - enabled - disabled - name: type in: query required: false description: Only rules of this type. schema: type: string enum: - email - domain - ip - cidr - asn - isp - city - name: search in: query required: false description: Part of a rule's value or note. schema: type: string responses: '200': description: It worked. content: application/json: schema: type: object properties: success: type: boolean message: nullable: true code: nullable: true data: type: array items: type: object properties: id: type: string type: type: string value: type: string label: type: string note: type: string enabled: type: boolean source: type: string customerId: nullable: true orderId: nullable: true hits: type: integer lastHitAt: nullable: true dateCreated: type: string updatedAt: type: string pages: type: integer total: type: integer meta: type: object properties: counts: type: object properties: all: type: integer enabled: type: integer disabled: type: integer limit: type: integer example: success: true message: null code: null data: - id: 0b5c7eb9-7e60-4c2c-8a95-87f5b5fe6b71 type: domain value: mailinator.com label: mailinator.com note: Throwaway inboxes enabled: true source: manual customerId: null orderId: null hits: 0 lastHitAt: null dateCreated: '2026-10-22T16:20:19Z' updatedAt: '2026-10-22T16:20:19.840Z' pages: 1 total: 1 meta: counts: all: 1 enabled: 1 disabled: 0 limit: 10000 '401': $ref: '#/components/responses/NoKey' '403': $ref: '#/components/responses/NotAllowed' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooMany' x-codeSamples: - lang: javascript label: Node.js source: | import Shoply from "@shoplygg/node"; const shoply = new Shoply({ apiKey: process.env.SHOPLY_API_KEY }); const page = await shoply.blacklist.list(); // Or every row of every page: for await (const row of shoply.blacklist.list()) { console.log(row); } - lang: php label: PHP source: | getenv('SHOPLY_API_KEY')]); $page = $shoply->blacklist->list(); // Or every row of every page: foreach ($shoply->blacklist->list() as $row) { print_r($row); } - lang: python label: Python source: | import shoply client = shoply.Client() # reads SHOPLY_API_KEY page = client.blacklist.list() # Or every row of every page: for row in client.blacklist.list(): print(row) components: responses: NoKey: description: >- No API key was sent, or the one sent is not a live key: `api_key_required`, `invalid_api_key`. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotAllowed: description: >- The key is real and may not do this: `missing_scope` (with `requiredScope`), `ip_not_allowed`, `account_unavailable`, or `dashboard_only` for something only a person in the dashboard may do. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotFound: description: >- There is no such thing in this store: `not_found`. A store that is not the key's own is answered the same way. content: application/json: schema: $ref: '#/components/schemas/Refusal' TooMany: description: >- The key has used up its budget for now: `rate_limited`. `Retry-After` says how many seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Refusal' schemas: Refusal: type: object properties: success: type: boolean example: false message: type: string description: What is wrong, in words for a person. code: type: string description: What is wrong, as a word that does not change. data: nullable: true errors: type: object description: >- For `validation_failed`: what is wrong with each field, by the field's name. additionalProperties: type: string required: - success - message - code securitySchemes: apiKey: type: http scheme: bearer description: >- A secret API key, made under Developers in the dashboard: `Authorization: Bearer shoply_sk_...` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.