> ## Documentation Index > Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt > Use this file to discover all available pages before exploring further. # Blacklist a customer > Stops the customer buying: their email is added to the store's blacklist, and with `addresses` the IP addresses their orders came from. Their open checkouts are refused from this moment. Needs the `customers.write` permission (Change Customers). ## OpenAPI ````yaml /api-reference/openapi.json post /stores/{storeId}/customers/{customerId}/blacklist openapi: 3.1.0 info: title: Shoply API version: '1' description: >- Everything a store's own server can do with a secret API key: its catalogue, orders, customers, marketing, finance and the rest of what the dashboard does. And the Customer API, which a buyer's own device asks with a token of theirs. servers: - url: https://api.shoply.gg/v1 security: - apiKey: [] tags: - name: API key - name: Store - name: Domain - name: Payment methods - name: Analytics - name: Storefronts - name: Storefront code - name: Payment Routing - name: Custom payment methods - name: Products - name: Product pictures - name: Stock - name: Categories - name: Upsells - name: Subscriptions - name: Orders - name: Invoices - name: Reviews - name: Coupons - name: Coupon categories - name: Coupon pop-up - name: Sales - name: Blog - name: Search settings - name: Redirects - name: Sitemap - name: Cart Recovery - name: Email Marketing - name: Email Templates - name: Customers - name: Affiliates - name: Support Tickets - name: Blacklist - name: Fraud protection - name: Disputes - name: Finance - name: Tax - name: Expenses - name: Expense setup - name: API requests - name: Webhook endpoints - name: Webhook deliveries - name: Customer API paths: /stores/{storeId}/customers/{customerId}/blacklist: post: tags: - Customers summary: Blacklist a customer description: >- Stops the customer buying: their email is added to the store's blacklist, and with `addresses` the IP addresses their orders came from. Their open checkouts are refused from this moment. Needs the `customers.write` permission (Change Customers). operationId: customers.blacklist parameters: - name: storeId in: path required: true description: >- The store's ID. A key reaches the store it was made in: `GET /key` answers which. schema: type: string - name: customerId in: path required: true description: The customer. schema: type: string - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: addresses: type: boolean description: >- Whether to blacklist the IP addresses their orders came from too, up to 20. default: true note: type: string description: Why. Kept with the rules it makes. responses: '200': description: It worked. content: application/json: schema: type: object properties: success: type: boolean message: nullable: true code: nullable: true data: type: object properties: balance: type: integer balanceAtCheckout: type: boolean tags: type: array items: type: object properties: id: type: string name: type: string tone: type: string automatic: type: boolean balanceHistory: type: array items: type: object properties: id: type: string kind: type: string amount: type: integer balanceAfter: type: integer currencyCode: type: string note: type: string orderId: nullable: true by: type: string dateCreated: type: string affiliate: nullable: true blacklisted: type: boolean blacklistedBy: type: array items: type: object properties: id: type: string type: type: string value: type: string part: type: string blacklistRules: type: integer knownAddresses: type: integer added: type: integer example: success: true message: null code: null data: balance: 5 balanceAtCheckout: true tags: - id: a537f7cb-125f-43a0-bd90-e29657620d76 name: Wholesale tone: primary automatic: false balanceHistory: - id: ce46d95e-769f-4a0d-9469-7298d67f7a7b kind: add amount: 5 balanceAfter: 5 currencyCode: USD note: Goodwill credit orderId: null by: api-docs-25aa8416@noblecheats.net dateCreated: '2026-10-22T16:20:19Z' affiliate: null blacklisted: true blacklistedBy: - id: 235ad0e3-5819-4709-aad5-d60358b15d07 type: email value: ada@example.com part: theirs blacklistRules: 1 knownAddresses: 0 added: 1 '401': $ref: '#/components/responses/NoKey' '403': $ref: '#/components/responses/NotAllowed' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/Refused' '429': $ref: '#/components/responses/TooMany' x-codeSamples: - lang: javascript label: Node.js source: | import Shoply from "@shoplygg/node"; const shoply = new Shoply({ apiKey: process.env.SHOPLY_API_KEY }); const result = await shoply.customers.blacklist("CUSTOMER_ID"); - lang: php label: PHP source: | getenv('SHOPLY_API_KEY')]); $result = $shoply->customers->blacklist('CUSTOMER_ID'); - lang: python label: Python source: | import shoply client = shoply.Client() # reads SHOPLY_API_KEY result = client.customers.blacklist("CUSTOMER_ID") components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- A word of your own for this one change, up to 180 letters, digits, dots, dashes, underscores and colons. Sent again with the same key, the request is not carried out twice: the first answer comes back, with `Idempotent-Replay: true`. schema: type: string responses: NoKey: description: >- No API key was sent, or the one sent is not a live key: `api_key_required`, `invalid_api_key`. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotAllowed: description: >- The key is real and may not do this: `missing_scope` (with `requiredScope`), `ip_not_allowed`, `account_unavailable`, or `dashboard_only` for something only a person in the dashboard may do. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotFound: description: >- There is no such thing in this store: `not_found`. A store that is not the key's own is answered the same way. content: application/json: schema: $ref: '#/components/schemas/Refusal' Refused: description: >- The request was understood and not carried out. `validation_failed` says what is wrong with each field under `errors`; other codes are the route's own. content: application/json: schema: $ref: '#/components/schemas/Refusal' TooMany: description: >- The key has used up its budget for now: `rate_limited`. `Retry-After` says how many seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Refusal' schemas: Refusal: type: object properties: success: type: boolean example: false message: type: string description: What is wrong, in words for a person. code: type: string description: What is wrong, as a word that does not change. data: nullable: true errors: type: object description: >- For `validation_failed`: what is wrong with each field, by the field's name. additionalProperties: type: string required: - success - message - code securitySchemes: apiKey: type: http scheme: bearer description: >- A secret API key, made under Developers in the dashboard: `Authorization: Bearer shoply_sk_...` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.