> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add or update workspace blocklist addresses

> An address is an email address (jane@acme.com) or a domain (acme.com).

Sets each address in the request to the given enforcement level on the workspace blocklist. The address itself is its key: there is no separate ID.

An address that isn't on the workspace blocklist is added. An address already at the requested level is left unchanged, so this endpoint is safe to retry. An address at the other level is moved to the requested level.

This endpoint only adds and updates the addresses in the request. Addresses on the workspace blocklist that aren't in the request are left alone; it never replaces the whole list.

Addresses are normalized: email addresses and domains are trimmed and lowercased, a URL is reduced to its hostname, and a leading `www.` is removed. The response returns the normalized value, which is the key for the address. Duplicate addresses are collapsed, and a request that gives the same address two different enforcement levels is rejected.

The request is applied all or nothing. Protected changes take effect immediately. Blocked changes take effect once each connected mailbox has re-synced, which may take a few minutes.

A user-level access token can only call this endpoint if the workspace member it acts for is a workspace admin.

This endpoint is in alpha and may be subject to breaking changes as we gather feedback.

Required scopes: `email_calendar_blocklist:read-write`.

Supported token levels: `workspace`, `user`.



## OpenAPI

````yaml https://api.attio.com/openapi/api put /v2/workspace_blocklist_addresses
openapi: 3.1.0
info:
  title: Attio API
  version: 2.0.0
  contact:
    name: Attio Support
    email: support@attio.com
    url: https://attio.com/help
servers:
  - url: https://api.attio.com
    description: Production
security:
  - oauth2: []
tags:
  - name: Objects
    description: >-
      Objects are the core data models inside of Attio. They contain standard
      objects, such as
      [people](/rest-api/endpoint-reference/standard-objects/people/list-person-records),
      [companies](/rest-api/endpoint-reference/standard-objects/companies/list-company-records)
      or [deals](/docs/standard-objects-deals), and custom objects that are
      specific to your use-case. See our [objects and lists
      guide](/docs/objects-and-lists) for more information.
  - name: Object views
    description: Object views are saved table or board layouts for an object.
  - name: Activities
    description: >-
      Activities model event-based data that can be logged against a record, for
      example a phone call. Each activity extends a schema, which supplies the
      attributes that every activity of that kind shares.
  - name: List views
    description: List views are saved table or board layouts for a list.
  - name: Attributes
    description: >-
      Attributes model properties of objects, lists and activities. Some
      attributes, such as the `name` attribute on a person, are system-defined,
      while others are user-defined. Attributes are one of [many
      types](/docs/attribute-types) such as text, location or select. See our
      [objects and lists guide](/docs/objects-and-lists) for more information.
  - name: Records
    description: >-
      Records are individual instances of objects e.g. a specific
      [person](/rest-api/endpoint-reference/standard-objects/people/list-person-records)
      or
      [company](/rest-api/endpoint-reference/standard-objects/companies/list-company-records).
      See our [objects and lists guide](/docs/objects-and-lists) for more
      information.
  - name: Activity records
    description: >-
      Activity records are individual instances of activities, for example one
      specific phone call.
  - name: SCIM groups
    description: >-
      SCIM groups represent Attio teams managed through the SCIM provisioning
      protocol.
  - name: SCIM schemas
    description: >-
      SCIM schemas describe the resource types supported by the SCIM service
      provider.
  - name: SCIM users
    description: >-
      SCIM users represent workspace members managed through the SCIM
      provisioning protocol.
  - name: Lists
    description: >-
      Lists are used to model a particular process. A list contains many records
      of a single object type, where each record is represented by an entry.
      Entries contain their own data from attributes defined on the list and
      also data from their parent record. See our [objects and lists
      guide](/docs/objects-and-lists) for more information.
  - name: Meta
    description: Meta endpoints are used to get information about the API token.
  - name: Entries
    description: >-
      Entries are elements in a list that reference a single parent record.
      Entries contain their own data from attributes defined on the list and
      also data from their parent record. See our [objects and lists
      guide](/docs/objects-and-lists) for more information.
  - name: Files
    description: >-
      Files are documents and folders linked to records, stored either in Attio
      or connected via external storage providers.
  - name: Workspace members
    description: >-
      Workspace members represent a user with access to a workspace. Workspace
      members are assigned roles that determine what they can do within the
      workspace.
  - name: Notes
    description: Notes are rich text documents that reference a single parent record.
  - name: Meetings
    description: >-
      Meetings are events synced from your calendar, added manually or added
      from third-party integrations.
  - name: Emails
    description: Emails are messages synced from connected mailboxes.
  - name: Sequences
    description: Sequences are automated email campaigns sent from Attio.
  - name: Workspace blocklist
    description: >-
      An address is an email address (jane@acme.com) or a domain (acme.com). The
      workspace blocklist is the workspace-wide list of addresses whose emails
      and calendar events are hidden in Attio. An email address matches only
      itself, and a domain matches every email address at that domain. The
      address itself is the key: there is no separate ID.
  - name: Call recordings
    description: >-
      Call recordings store video, audio, transcript and speaker information for
      calls. They are linked to meetings.
  - name: Transcripts
    description: >-
      Transcripts contain the speech segments and speaker information for a call
      recording. They are linked to call recordings.
  - name: Tasks
    description: >-
      A task is a defined, actionable item with references to linked records and
      assigned workspace members.
  - name: Webhooks
    description: >-
      Webhooks allow you to listen for changes to data in Attio, for example
      when a record is updated.
  - name: Threads
    description: >-
      Threads are groups of
      [comments](/rest-api/endpoint-reference/comments/get-a-comment) on either
      a record or entry.
  - name: Comments
    description: >-
      Comments are messages on a
      [thread](/rest-api/endpoint-reference/threads/list-threads).
  - name: People
    description: >-
      People are one of the core objects inside of Attio. Person records can be
      added to lists and can be created automatically when syncing your mailbox.
  - name: Companies
    description: >-
      Companies are one of the core objects inside of Attio. Company records can
      be added to lists and can be created automatically when syncing your
      mailbox.
  - name: Users
    description: >-
      Users are an optional standard object that represents a user of your
      system. Users can belong to many workspaces.
  - name: Deals
    description: >-
      Deals are an optional standard object that represent a deal or
      opportunity.
  - name: Workspaces
    description: >-
      Workspaces are an optional standard object that represent a workspace or
      account in your system. Workspaces have many users and can be used to
      model a multi-tenant system. A company record can optionally have multiple
      workspaces.
  - name: SQL
    description: >-
      Query records and list entries across your workspace using SQL. A single
      query can reference any object or list in the workspace.
paths:
  /v2/workspace_blocklist_addresses:
    put:
      tags:
        - Workspace blocklist
      summary: Add or update workspace blocklist addresses
      description: >-
        An address is an email address (jane@acme.com) or a domain (acme.com).


        Sets each address in the request to the given enforcement level on the
        workspace blocklist. The address itself is its key: there is no separate
        ID.


        An address that isn't on the workspace blocklist is added. An address
        already at the requested level is left unchanged, so this endpoint is
        safe to retry. An address at the other level is moved to the requested
        level.


        This endpoint only adds and updates the addresses in the request.
        Addresses on the workspace blocklist that aren't in the request are left
        alone; it never replaces the whole list.


        Addresses are normalized: email addresses and domains are trimmed and
        lowercased, a URL is reduced to its hostname, and a leading `www.` is
        removed. The response returns the normalized value, which is the key for
        the address. Duplicate addresses are collapsed, and a request that gives
        the same address two different enforcement levels is rejected.


        The request is applied all or nothing. Protected changes take effect
        immediately. Blocked changes take effect once each connected mailbox has
        re-synced, which may take a few minutes.


        A user-level access token can only call this endpoint if the workspace
        member it acts for is a workspace admin.


        This endpoint is in alpha and may be subject to breaking changes as we
        gather feedback.


        Required scopes: `email_calendar_blocklist:read-write`.


        Supported token levels: `workspace`, `user`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                data:
                  type: object
                  properties:
                    addresses:
                      type: array
                      items:
                        type: object
                        properties:
                          address:
                            type: string
                            description: >-
                              An email address or a domain. Attio works out
                              which one it is. Email addresses are trimmed and
                              lowercased, and their host must be a valid domain.
                              Domains are trimmed and lowercased, a URL is
                              reduced to its hostname, and a leading `www.` is
                              removed; subdomains are kept. Single labels
                              (`acme`), bare public suffixes (`com`), unknown
                              suffixes, IP addresses, wildcards and values over
                              253 characters are rejected.
                            example: jane@acme.com
                          enforcement_level:
                            type: string
                            enum:
                              - protected
                              - blocked
                            description: >-
                              `protected`: emails and calendar events are hidden
                              unless at least one participant is not on the
                              workspace blocklist. `blocked`: they are hidden
                              even when other participants are included.
                            example: blocked
                        required:
                          - address
                          - enforcement_level
                        additionalProperties: false
                      minItems: 1
                      maxItems: 500
                      description: >-
                        The addresses to set and the enforcement level each
                        should have. A maximum of 500 addresses can be provided
                        per request. The same address may not appear with two
                        different enforcement levels.
                  required:
                    - addresses
                  additionalProperties: false
              required:
                - data
              additionalProperties: false
            examples:
              Add, keep and move addresses:
                summary: >-
                  Set email addresses and domains to different enforcement
                  levels in one request
                value:
                  data:
                    addresses:
                      - address: lists@acme.com
                        enforcement_level: blocked
                      - address: https://www.newsletter.example.com
                        enforcement_level: blocked
                      - address: jane@acme.com
                        enforcement_level: protected
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        address:
                          type: string
                          description: >-
                            The normalized email address or domain. It is the
                            address's key on the workspace blocklist.
                          example: jane@acme.com
                        address_type:
                          type: string
                          enum:
                            - email_address
                            - domain
                          description: Whether the address is an email address or a domain.
                          example: email_address
                        enforcement_level:
                          type: string
                          enum:
                            - protected
                            - blocked
                          description: >-
                            `protected`: emails and calendar events are hidden
                            unless at least one participant is not on the
                            workspace blocklist. `blocked`: they are hidden even
                            when other participants are included.
                          example: blocked
                        created_at:
                          type: string
                          format: date-time
                          description: >-
                            When the address was given its current enforcement
                            level.
                          example: '2026-10-28T09:12:44.210000000Z'
                      required:
                        - address
                        - address_type
                        - enforcement_level
                        - created_at
                required:
                  - data
                description: Success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  status_code:
                    type: number
                    enum:
                      - 400
                  type:
                    type: string
                    enum:
                      - invalid_request_error
                  code:
                    type: string
                    enum:
                      - validation_type
                  message:
                    type: string
                    example: Body payload validation error.
                required:
                  - status_code
                  - type
                  - code
                  - message
                description: Bad Request
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  status_code:
                    type: number
                    enum:
                      - 403
                  type:
                    type: string
                    enum:
                      - auth_error
                  code:
                    anyOf:
                      - type: string
                        enum:
                          - unauthorized
                      - type: string
                        enum:
                          - billing_error
                  message:
                    type: string
                    example: >-
                      A user-level access token can only manage the workspace
                      blocklist if the member it acts for is a workspace admin.
                required:
                  - status_code
                  - type
                  - code
                  - message
                description: Forbidden
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                type: object
                properties:
                  status_code:
                    type: number
                    enum:
                      - 409
                  type:
                    type: string
                    enum:
                      - invalid_request_error
                  code:
                    type: string
                    enum:
                      - uniqueness_conflict
                  message:
                    type: string
                    example: >-
                      One or more addresses were changed by a concurrent
                      request. Please retry.
                required:
                  - status_code
                  - type
                  - code
                  - message
                description: Conflict
      security:
        - oauth2:
            - email_calendar_blocklist:read-write
components:
  securitySchemes:
    oauth2:
      type: oauth2
      description: This API uses OAuth 2.0 with the authorization code grant flow.
      flows:
        authorizationCode:
          authorizationUrl: https://app.attio.com/authorize
          tokenUrl: https://app.attio.com/oauth/token
          scopes:
            user_management:read: View workspace members.
            user_management:read-write: View workspace members.
            record_permission:read: View, and optionally write, records.
            record_permission:read-write: View, and optionally write, records.
            object_configuration:read: >-
              View, and optionally write, the configuration and attributes of
              objects.
            object_configuration:read-write: >-
              View, and optionally write, the configuration and attributes of
              objects.
            list_entry:read: View, and optionally write, the entries in a list.
            list_entry:read-write: View, and optionally write, the entries in a list.
            list_configuration:read: >-
              View, and optionally write, the configuration and attributes of
              lists.
            list_configuration:read-write: >-
              View, and optionally write, the configuration and attributes of
              lists.
            public_collection:read: >-
              View, and optionally write, both the settings and information
              within public collections.
            public_collection:read-write: >-
              View, and optionally write, both the settings and information
              within public collections.
            private_collection:read: >-
              View, and optionally modify, both the settings and information of
              all collections within the workspace, regardless of their access
              settings.
            private_collection:read-write: >-
              View, and optionally modify, both the settings and information of
              all collections within the workspace, regardless of their access
              settings.
            comment:read: View comments (and threads), and optionally write comments.
            comment:read-write: View comments (and threads), and optionally write comments.
            task:read: View, and optionally write, tasks.
            task:read-write: View, and optionally write, tasks.
            note:read: View, and optionally write, notes.
            note:read-write: View, and optionally write, notes.
            meeting:read: View, and optionally write, meetings.
            meeting:read-write: View, and optionally write, meetings.
            call_recording:read: >-
              View, and optionally write, call recordings, transcripts and
              speakers for meetings.
            call_recording:read-write: >-
              View, and optionally write, call recordings, transcripts and
              speakers for meetings.
            webhook:read: View, and optionally manage, webhooks.
            webhook:read-write: View, and optionally manage, webhooks.
            file:read: View, and upload files.
            file:read-write: View, and upload files.
            email:read: View email metadata. Email content is never exposed.
            email:read-write: View email metadata. Email content is never exposed.
            activity_configuration:read: >-
              View, and optionally write, the configuration and attributes of
              activities.
            activity_configuration:read-write: >-
              View, and optionally write, the configuration and attributes of
              activities.
            activity_record:read: View, and optionally write, activity records.
            activity_record:read-write: View, and optionally write, activity records.
            sequence_unsubscribe:read: View, and optionally add to, the sequence unsubscribe list.
            sequence_unsubscribe:read-write: View, and optionally add to, the sequence unsubscribe list.
            email_calendar_blocklist:read: >-
              View, and optionally manage, the addresses (email addresses and
              domains) whose emails and calendar events are hidden in Attio.
            email_calendar_blocklist:read-write: >-
              View, and optionally manage, the addresses (email addresses and
              domains) whose emails and calendar events are hidden in Attio.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.