getBlocklistItems

This method lists all items present in a Blocklist.

Important

This method has been updated to version 1.2. For information applicable to version 1.0, refer to this section.
Version 1.0 returns only hash-type blocklist rules.

Parameters

Parameter	Description	Included in request	Type	Values
`companyId`	The ID of the company to which the Blocklist item belongs.	Optional	String	Must be the valid ID of a managed company. Default value: the company the API key used to make the request belongs to. Example "companyId": "58541613aaed7090058b4567"
`page`	The number of the results page currently displayed.	Optional	Integer	Default value: `1` Example "page": 1
`perPage`	The number of items displayed on a page.	Optional	Integer	Possible values: `1` - `100`. Default value: `30`. Example "perPage": 50

Parameter

Description

Included in request

Type

Values

companyId

The ID of the company to which the Blocklist item belongs.

Optional

String

Must be the valid ID of a managed company.

Default value: the company the API key used to make the request belongs to.

page

The number of the results page currently displayed.

Optional

Integer

Default value: 1

perPage

The number of items displayed on a page.

Optional

Integer

Possible values: 1 - 100.

Default value: 30.

General parameters

These are common parameters, available across all public API methods:

Parameter	Description	Included in request	Type	Value requirements
`id`	This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking.	Mandatory	String	No additional requirements. Example "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
`method`	The name of the method you are using to send the request.	Mandatory	String	Must be a valid method name. Example "method": "methodName"
`jsonrpc`	The version of JSON-RPC used by the request and the response.	Mandatory	String	The only possible value is `2.0`. Example "jsonrpc": "2.0"
`params`	An object containing the configuration of the request.	Mandatory	Object	No additional requirements. Example "params": {...}

Return value

This method returns a result Object containing information regarding existing blocklist rules. The returned object contains:

Attribute	Type	Description
`total`	Integer	The total number of rules returned by the request.
`page`	Integer	The number of the page currently being displayed.
`perPage`	Integer	The number of results being displayed per page.
`pagesCount`	Integer	The total number of pages that the request returned.
`items`	Array of objects	The list of existing rules associated with the target company. Refer to `items` for a detailed description of each object in the array.

Objects

`items`

Attribute	Type	Description
`id`	String	The ID of the item. You can use this ID to remove the item from the Blocklist. Refer to removeFromBlocklist.
`type`	String	The type of the rule included in the list. Possible values: `hash` `path` `connection`
`source`	Object	Provides information on how the item was added to the list. For detailed information on the parameters included in this object, refer to `source`.
`company`	Object	Provides information on the company that the item belongs to. For detailed information on the parameters included in this object, refer to `company`.
`owner`	Object	Provides information on the GravityZone user that created the rule. For detailed information on the parameters included in this object, refer to `owner`.
`created`	String, timestamp	The date and time when this item was added to the blocklist.
`details`	Object	Contains information regarding the rule. For detailed information on the settings included in this object, refer to `details`.

`source`

Attribute	Type	Description
`type`	String	Indicates the type of the source from which the entry originated. Possible values: `incident` `import` `manual` `MDR`: The rule was added to the Blocklist by an MDR analyst.
`description`	String	The description given to this item when added to the list.

Attribute

Type

Description

type

String

Indicates the type of the source from which the entry originated.

Possible values:

incident
import
manual
MDR: The rule was added to the Blocklist by an MDR analyst.

description

String

The description given to this item when added to the list.

`company`

Attribute	Type	Description
`id`	String	The ID of the company.
`name`	String	The name of the company the item belongs to.

`owner`

Attribute	Type	Description
`id`	String	The ID of the GravityZone user.
`userName`	String	The email address of the user.

`details`

The attributes contained in the details object vary depending on the rule type.

Attribute	Type	Description
`type` is `hash`
`algorithm`	String	The algorithm used to obtain the hash. Possible values: `sha256` `md5`
`hash`	String	The hash associated with the file that needs to be blocked.
`file`	Object	Details about the file corresponding to the hash. Refer to `file`.
`type` is `path`
`path`	String	All applications that are launched from the specified path are blocked.
`type` is `connection`
`ruleName`	String	The name under which the rule is listed in the rules table.
`commandLine`	String	If included, the rule applies only when an application is opened by using the command line interface with the specified command.
`protocol`	String	The rule applies only if a specific IP protocol is used by the connection. Possible values: `any` `TCP` `UDP` A protocol from the list here (the Keyword column)
`direction`	String	The rule applies only to connections of a specific direction. Possible values: `inbound` `outbound` `both`
`ipVersion`	String	The rule applies only to connections to or from a specific IP type. Possible values: `any` `IPV4` `IPV6`
`localAddress`	Object	If included, the rule applies only to connections to or from specific local network addresses. Refer to `localAddress`.
`remoteAddress`	Object	If included, the rule applies only to connections to or from specific remote addresses. Refer to `remoteAddress`.
`directlyConnected`	Object	If enabled, the rule applies only to connections to or from specific macOS addresses. Refer to `directlyConnected`.
`operatingSystems`	Array of strings	The rule applies only to connections to or from endpoints using the specified operating systems. Possible values for each element of the array: `windows` `mac`
`path`	String	Determines which application the rule applies to.
`hash`	String	The MD5 of the application.
`ruleId`	String	An internal ID of the rule.

`file`

Attribute	Type	Description
`name`	String	The name of the file corresponding to the hash.

`localAddress`

Attribute	Type	Description
`any`	Boolean	If `false`, only connections originating from the address specified under the `ipMask` setting are blocked. If `true`, all connections are blocked regardless of IP address.
`ipMask`	String	If `any` is `false`, only connections to or from the address specified under this setting are blocked. The value can be in an IP or an IP/Mask format.
`portRange`	String	If a range is used, only connections made through ports between these two values are blocked. If specific ports are used, only connections made through these ports are blocked.

Attribute

Type

Description

any

Boolean

If false, only connections originating from the address specified under the ipMask setting are blocked.

If true, all connections are blocked regardless of IP address.

ipMask

String

If any is false, only connections to or from the address specified under this setting are blocked.

The value can be in an IP or an IP/Mask format.

portRange

String

If a range is used, only connections made through ports between these two values are blocked.

If specific ports are used, only connections made through these ports are blocked.

`remoteAddress`

Attribute	Type	Description
`any`	Boolean	If `false`, only connections originating from the address specified under the `ipMask` setting are blocked. If `true`, all connections are blocked, regardless of IP address.
`ipMask`	String	If `any` is `false`, only connections to or from the address specified under this setting are blocked. The value can be in an IP or IP/Mask format.
`portRange`	String	If a range is used, only connections made through ports between these two values are blocked. If specific ports are used, only connections made through these ports are blocked.

Attribute

Type

Description

any

Boolean

If false, only connections originating from the address specified under the ipMask setting are blocked.

If true, all connections are blocked, regardless of IP address.

ipMask

String

If any is false, only connections to or from the address specified under this setting are blocked.

The value can be in an IP or IP/Mask format.

portRange

String

If a range is used, only connections made through ports between these two values are blocked.

If specific ports are used, only connections made through these ports are blocked.

`directlyConnected`

Attribute	Type	Description
`enable`	Boolean	Indicates if this option is enabled.
`remoteMac`	String	Only connections from the specified macOS addresses are allowed.

Example

Request

{
   "params": {
        "companyId": "69e74165500917a5160750d4",
        "page": 1,
        "perPage": 100
    },
    "jsonrpc": "2.0",
    "method": "getBlocklistItems",
    "id": "5087eab8-b74f-4a3e-85b3-4271e85890d5"
}

Response

{
  "id": "5087eab8-b74f-4a3e-85b3-4271e85890d5",
  "jsonrpc": "2.0",
  "result": {
    "total": 3,
    "page": 1,
    "perPage": 100,
    "pagesCount": 1,
    "items": [
      {
        "type": "hash",
        "source": {
          "type": "manual",
          "description": null
        },
        "company": {
          "id": "69e74165500917a5160750d4",
          "name": "Bitdefender"
        },
        "owner": {
          "id": "69e74168500917a5160750df",
          "userName": "user@bitdefender.com"
        },
        "created": "2026-08-04T16:09:52",
        "id": "6a71e4a08f260ee6ff019ca4",
        "details": {
          "algorithm": "sha256",
          "hash": "1e0905327f443c54aa617e2ff323067c985428e5566886f2aa8296cddfe6ddf9",
          "file": {
            "name": null
          }
        }
      },
      {
        "type": "path",
        "source": {
          "type": "manual",
          "description": "test"
        },
        "company": {
          "id": "69e74165500917a5160750d4",
          "name": "Bitdefender"
        },
        "owner": {
          "id": "69e74168500917a5160750df",
          "userName": "user@bitdefender.com"
        },
        "created": "2026-08-04T16:09:52",
        "id": "6a71e4a0049f483681066b72",
        "details": {
          "path": "C:\\aaa.exe"
        }
      },
      {
        "type": "connection",
        "source": {
          "type": "manual",
          "description": "test"
        },
        "company": {
          "id": "69e74165500917a5160750d4",
          "name": "Bitdefender"
        },
        "owner": {
          "id": "69e74168500917a5160750df",
          "userName": "user@bitdefender.com"
        },
        "created": "2026-08-04T16:09:52",
        "id": "6a71e4a0286266ec5b0a0df2",
        "details": {
          "remoteAddress": {
            "any": true,
            "ipMask": null,
            "portRange": "300-400"
          },
          "localAddress": {
            "any": false,
            "ipMask": "10.10.10.10/32",
            "portRange": "300-400"
          },
          "directlyConnected": {
            "enable": true,
            "remoteMac": "AA:AA:AA:AA:AA:AA;CC:CC:CC:CC:CC:CC;BB:BB:BB:BB:BB:BB"
          },
          "protocol": "any",
          "path": null,
          "hash": null,
          "commandLine": null,
          "ipVersion": "any",
          "direction": "both",
          "ruleName": "rule 1#",
          "ruleId": "fabd7c56-0f68-4042-aff8-5698baa5b286",
          "operatingSystems": [
            "windows"
          ]
        }
      }
    ]
  }
}

Version 1.0

Parameters

Parameter	Type	Included in request	Description
`companyId`	String	Optional	When set, the method lists only the hash-type items in the Blocklist for the managed company with the provided ID.
`page`	Integer	Optional	The results page number. The default value is `1`.
`perPage`	Integer	Optional	The number of items displayed on a page. The upper limit is `100` items per page. Default value: `30` items per page.

Parameter

Type

Included in request

Description

companyId

String

Optional

When set, the method lists only the hash-type items in the Blocklist for the managed company with the provided ID.

page

Integer

Optional

The results page number.

The default value is 1.

perPage

Integer

Optional

The number of items displayed on a page.

The upper limit is 100 items per page.

Default value: 30 items per page.

General parameters

These are common parameters, available across all public API methods:

Parameter	Description	Included in request	Type	Value requirements
`id`	This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking.	Mandatory	String	No additional requirements. Example "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
`method`	The name of the method you are using to send the request.	Mandatory	String	Must be a valid method name. Example "method": "methodName"
`jsonrpc`	The version of JSON-RPC used by the request and the response.	Mandatory	String	The only possible value is `2.0`. Example "jsonrpc": "2.0"
`params`	An object containing the configuration of the request.	Mandatory	Object	No additional requirements. Example "params": {...}

Return value

This method returns a result Object containing information regarding existing hash-type blocklist rules. The returned object contains:

Attribute	Type	Description
`total`	Integer	The total number of rules returned by the request.
`page`	Integer	The number of the page currently being displayed.
`perPage`	Integer	The number of results being displayed per page.
`pagesCount`	Integer	The total number of pages that the request returned.
`items`	Array of objects	The list of existing hash-type rules associated with the target company. Refer to `items` for a detailed description of each object in the array.

Objects

`items`

Attribute	Type	Description
`companyId`	String	The ID of the company that the Blocklist item belongs to.
`hash`	String	The hash associated with the file that needs to be blocked.
`hashType`	Integer	The algorithm used to obtain the hash. Possible values: `1` - SHA256 `2` - MD5
`filename`	String	The name of file corresponding to the hash. This field is only displayed if this information exists.
`id`	String	The ID of the hash item in the Blocklist. You can use this ID to remove the item from the Blocklist. Refer to removeFromBlocklist.
`source`	Integer	The source from where the hash entry hash originated. Possible values: `1` - Incident `2` - Import `3` - Manual `4` - MDR
`sourceInfo`	String	The description of the item, as the user provided when adding the item to the Blocklist.

Example

Request:

  {
      "params": {
          "companyId" : "5b680f6fb1a43d860a7b23c8"
      },
      "jsonrpc": "2.0",
      "method": "getBlocklistItems",
      "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
  }

Response:

   {
       "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
       "jsonrpc": "2.0",
       "result": {
           "items": [
               {
                   "companyId": "5b680f6fb1a43d860a7b23c8",
                   "hash": "098f6bcd4621d373cade4e832627b4f6",
                   "hashType": 2,
                   "id": "5b7ac19bb1a43dfb107b23c6",
                   "source": 3,
                   "sourceInfo": "Added from public API"
               },
               {
                   "companyId": "5b680f6fb1a43d860a7b23c8",
                   "filename": "file.txt",
                   "hash": "f696282aa4cd4f614aa995190cf442fe",
                   "hashType": 2,
                   "id": "5b7ac19bb1a43dfb107b23c7",
                   "source": 1,
                   "sourceInfo": "Added from incident 1"
               }
           ],
           "page": 1,
           "pagesCount": 1,
           "perPage": 30,
           "total": 2
       }
  }

In this section:

getBlocklistItems

Important

Parameters

General parameters

Return value

Objects

items

source

company

owner

details

file

localAddress

remoteAddress

directlyConnected

Example

Version 1.0

Parameters

General parameters

Return value

Objects

items

Example

Search results

`items`

`source`

`company`

`owner`

`details`

`file`

`localAddress`

`remoteAddress`

`directlyConnected`

`items`