# Blacklist and Duplicates

https://dev.wisecp.com/uk/blacklist-and-duplicates

The five endpoints that blacklist a client, edit the record, take them off the list, and find accounts that might be the same person.

## Overview

These endpoints do two jobs together: blacklisting a client, and finding other accounts that **might be the same person**. They belong to one decision — someone who gets blacklisted usually comes back with a second account.

Blacklisting is more than a flag: you choose which restrictions come with it. Switch none on and the client is only marked.

## Reference

### Blacklist Status

get/api/v1/admin/clients/{id}/blacklist

`Clients/GetClientBlacklist` admin

Returns whether the client is blacklisted, why, and which restrictions are on.

Response fields data — 6

blacklistedboolWhether the client is blacklisted.

reasonstringThe reason. Values: `payment_fraud` · `chargeback` · `abuse` · `spam` · `tos_violation` · `false_info` · `other`

notesstringA free-text note.

restrictionsobject 4 fieldsThe restrictions that are on.

block_new_ordersboolBlocks new orders.

block_renewalsboolBlocks renewals.

block_ticketsboolWhether the client is blocked from opening tickets. This is the block in force: it is also on when the account's own ticket block is on.

suspend_servicesboolSuspends the services.

blacklisted_bystringName of the admin who blacklisted.

blacklisted_atstringWhen the client was blacklisted.

Errors 2

not_found404No such client.

insufficient_scope403The key lacks the required scope.

Request cURL JavaScript PHP (HTTP) PHP (Internal)

```bash
curl 'https://panel.example.com/api/v1/admin/clients/42/blacklist' \
  -H "Authorization: Bearer $API_KEY"
```

```javascript
const res  = await fetch('https://panel.example.com/api/v1/admin/clients/42/blacklist', {
  headers: { Authorization: `Bearer ${apiKey}` },
});
const body = await res.json();
```

```php
$ch = curl_init('https://panel.example.com/api/v1/admin/clients/42/blacklist');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
```

```php
$response = Api::Clients()->GetClientBlacklist(['id' => 42]);

if ($response['data']['blacklisted'] ?? false) {
    $reason = $response['data']['reason'];
}
```

### Blacklisting a Client

post/api/v1/admin/clients/{id}/blacklist

`Clients/CreateClientBlacklist` admin can suspend services

Blacklists the client and applies the restrictions you choose.

Body 3

reasonstringrequiredThe reason. Values: `payment_fraud` · `chargeback` · `abuse` · `spam` · `tos_violation` · `false_info` · `other`

notesstringA free-text note explaining the decision.

restrictionsobject 4 fieldsWhich restrictions to switch on. Send none and none are applied; the client is only flagged.

block_new_ordersboolBlocks new orders.

block_renewalsboolBlocks renewals.

block_ticketsboolBlocks opening tickets. Leave it out and the block the account already has is kept. `true` switches it on, an explicit `false` switches it off.

suspend_servicesboolSuspends the services.

Response fields data

dataobjectThe blacklist record, returned with `201`. Same shape as the status endpoint above.

Errors 4

not_found404No such client.

reason_invalid422The reason is not one of the allowed values.

blocked_by_gate422A hook on `gate:user.blacklist_add` vetoed the operation.

insufficient_scope403The key lacks the required scope.

Request cURL JavaScript PHP (HTTP) PHP (Internal)

```bash
curl -X POST 'https://panel.example.com/api/v1/admin/clients/42/blacklist' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"reason":"chargeback","notes":"Two chargebacks","restrictions":{"block_new_orders":true,"suspend_services":true}}'
```

```javascript
const res = await fetch('https://panel.example.com/api/v1/admin/clients/42/blacklist', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"reason":"chargeback","notes":"Two chargebacks","restrictions":{"block_new_orders":true,"suspend_services":true}}),
});

const body = await res.json();
```

```php
$ch = curl_init('https://panel.example.com/api/v1/admin/clients/42/blacklist');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'reason'       => 'chargeback',
        'notes'        => 'Two chargebacks',
        'restrictions' => [
            'block_new_orders' => true,
            'suspend_services' => true,
        ],
    ]),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
```

```php
$response = Api::Clients()->CreateClientBlacklist([
    'id'           => 42,
    'reason'       => 'chargeback',
    'notes'        => 'Two chargebacks',
    'restrictions' => [
        'block_new_orders' => true,
        'suspend_services' => true,
    ],
]);
```

### Editing a Blacklist Record

put/api/v1/admin/clients/{id}/blacklist

`Clients/UpdateClientBlacklist` admin can suspend services

Replaces the reason, note and restrictions of a standing record. Who blacklisted the client, and when, stay as they were.

Body 4

reasonstringrequiredThe new reason. Same values as when blacklisting.

notesstringThe new note. It replaces the stored one; send an empty string to clear it.

restrictionsobjectThe full set of restrictions, same four fields as when blacklisting. A field you leave out is switched off, `block_tickets` included.

reactivate_servicesboolRead only when `suspend_services` goes from on to off: reactivates the services this blacklisting suspended.

Response fields data

dataobjectThe updated record, returned with `200`. Same shape as the status endpoint above.

Errors 5

not_found404No such client.

not_blacklisted422The client is not on the blacklist.

reason_invalid422The reason is not one of the allowed values.

blocked_by_gate422A hook on `gate:user.blacklist_update` vetoed the operation.

insufficient_scope403The key lacks the required scope.

Request cURL JavaScript PHP (HTTP) PHP (Internal)

```bash
curl -X PUT 'https://panel.example.com/api/v1/admin/clients/42/blacklist' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"reason":"tos_violation","notes":"Reviewed with legal","restrictions":{"block_new_orders":true,"block_tickets":true}}'
```

```javascript
const res = await fetch('https://panel.example.com/api/v1/admin/clients/42/blacklist', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"reason":"tos_violation","notes":"Reviewed with legal","restrictions":{"block_new_orders":true,"block_tickets":true}}),
});

const body = await res.json();
```

```php
$ch = curl_init('https://panel.example.com/api/v1/admin/clients/42/blacklist');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'PUT',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'reason'       => 'tos_violation',
        'notes'        => 'Reviewed with legal',
        'restrictions' => [
            'block_new_orders' => true,
            'block_tickets'    => true,
        ],
    ]),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
```

```php
$current = Api::Clients()->GetClientBlacklist(['id' => 42]);

$response = Api::Clients()->UpdateClientBlacklist([
    'id'           => 42,
    'reason'       => 'tos_violation',
    'notes'        => 'Reviewed with legal',
    'restrictions' => $current['data']['restrictions'] ?? [],
]);
```

### Removing from the Blacklist

delete/api/v1/admin/clients/{id}/blacklist

`Clients/DeleteClientBlacklist` admin

Removes the blacklist record and lifts the client's ticket block with it. Bringing suspended services back is a separate choice.

Body 1

reactivate_servicesboolReactivates the services that this blacklisting suspended. Leave it out and they stay suspended.

Response fields data

removedboolWhether the removal succeeded.

Errors 3

not_found404No such client.

not_blacklisted422The client is not on the blacklist.

insufficient_scope403The key lacks the required scope.

Request cURL JavaScript PHP (HTTP) PHP (Internal)

```bash
curl -X DELETE 'https://panel.example.com/api/v1/admin/clients/42/blacklist' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"reactivate_services":true}'
```

```javascript
const res = await fetch('https://panel.example.com/api/v1/admin/clients/42/blacklist', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ reactivate_services: true }),
});

const body = await res.json();
```

```php
$ch = curl_init('https://panel.example.com/api/v1/admin/clients/42/blacklist');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'DELETE',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(['reactivate_services' => true]),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
```

```php
$response = Api::Clients()->DeleteClientBlacklist([
    'id'                  => 42,
    'reactivate_services' => true,
]);
```

### Duplicate Account Scan

get/api/v1/admin/clients/{id}/duplicates

`Clients/GetClientDuplicates` admin IP · name · company

Returns other accounts that share the client's IP, name or company name.

Response fields data — 2

currentobjectA summary of the client under review: `id`, `full_name`, `company_name`, `ip`, `created_at`.

matchesobject[] 7 fieldsThe matching accounts.

idintId of the matching client.

full_namestringFull name.

company_namestringCompany name.

ipstringThe account's stored IP, refreshed at each of the client's own sign-ins.

created_atstring | nullSign-up date.

days_apartintDays between the two sign-up dates. An absolute value.

match_typesstring[]What matched: `ip`, `name`, `company`.

matched_ipsstring[]The addresses behind an `ip` match. Empty when the account matched by name or company only.

Errors 2

not_found404No such client.

insufficient_scope403The key lacks the required scope.

Request cURL JavaScript PHP (HTTP) PHP (Internal)

```bash
curl 'https://panel.example.com/api/v1/admin/clients/42/duplicates' \
  -H "Authorization: Bearer $API_KEY"
```

```javascript
const res  = await fetch('https://panel.example.com/api/v1/admin/clients/42/duplicates', {
  headers: { Authorization: `Bearer ${apiKey}` },
});
const body = await res.json();

const sameIp = body.data.matches.filter((m) => m.match_types.includes('ip'));
```

```php
$ch = curl_init('https://panel.example.com/api/v1/admin/clients/42/duplicates');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);
```

```php
$response = Api::Clients()->GetClientDuplicates(['id' => 42]);

foreach ($response['data']['matches'] as $match) {
    // Same IP a few days apart is a stronger signal than a name match.
    if (in_array('ip', $match['match_types'], true) && $match['days_apart'] < 7) {
        $suspects[] = $match['id'];
    }
}
```

Response 200

```json
{
  "data": {
    "current": {
      "id": 42,
      "full_name": "John Doe",
      "company_name": "",
      "ip": "203.0.113.10",
      "created_at": "2026-01-01 10:00:00"
    },
    "matches": [
      {
        "id": 57,
        "full_name": "J. Doe",
        "company_name": "",
        "ip": "203.0.113.10",
        "created_at": "2026-01-03 09:20:00",
        "days_apart": 2,
        "match_types": ["ip", "name"],
        "matched_ips": ["203.0.113.10"]
      }
    ]
  }
}
```

## Pitfalls

> **Removing does not bring services back**
> 
> Removing the blacklist record does not reactivate suspended services on its own. Send `reactivate_services` if you want them back; otherwise the client is off the list while the services stay suspended.

> **The ticket block is one setting with two switches**
> 
> `block_tickets` here and `ticket_blocked` on the support settings endpoint are written together. Removing the record lifts both, and an edit that leaves `block_tickets` out lifts both too.
> 
> To keep the block on a client you take off the list, switch it back on with `PATCH /clients/{id}/support-settings`. A block set on a client who is not blacklisted stays on its own.

> **A match is not a verdict**
> 
> The same IP can be a home or an office, and the same name can be a coincidence. Read `match_types` together with `days_apart`: two accounts opened from one IP days apart is a far stronger signal than two that only share a name.

> **Staff addresses are not evidence**
> 
> IP evidence is the stored IP plus the client's own sign-in records. Addresses staff work from are left out, including sessions opened with **Sign In as Client**. Read `matched_ips` to see which address produced a match.

## Related Articles

- [Client Endpoints](https://dev.wisecp.com/en/client-endpoints)
- [Client Security](https://dev.wisecp.com/en/client-security-endpoints)
- [Request and Response Format](https://dev.wisecp.com/en/request-and-response-format)