Skip to content
Cloudflare API
Start here
API Reference
Email Security
Settings
Block Senders

Batch blocked sender operations

POST/accounts/{account_id}/email-security/settings/block_senders/batch

Executes multiple blocked sender operations atomically: delete, partially update, replace, and create blocked sender patterns in a single request. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Cloud Email Security: Write
Path ParametersExpand Collapse
account_id: string

Identifier.

maxLength32
Body ParametersJSONExpand Collapse
deletes: array of object { id }

IDs of the blocked sender patterns to delete.

id: string

Blocked sender pattern identifier.

formatuuid
patches: array of object { id, comments, created_at, 5 more }

Partial updates to apply — each entry carries the pattern’s ID and only the fields to change.

id: string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
posts: array of object { is_regex, pattern, pattern_type, 5 more }

Blocked sender patterns to create.

is_regex: boolean

Whether pattern is a regular expression instead of a literal value.

pattern: string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
puts: array of object { id, is_regex, pattern, 5 more }

Full replacements to apply — each entry carries the pattern’s ID and every field of its new value.

id: string

Blocked sender pattern identifier.

formatuuid
is_regex: boolean

Whether pattern is a regular expression instead of a literal value.

pattern: string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
ReturnsExpand Collapse
errors: array of object { code, message, documentation_url, source }
code: number
minimum1000
message: string
documentation_url: optional string
source: optional object { pointer }
pointer: optional string
messages: array of object { code, message, documentation_url, source }
code: number
minimum1000
message: string
documentation_url: optional string
source: optional object { pointer }
pointer: optional string
success: true

Whether the API call was successful.

result: optional object { deletes, patches, posts, puts }
deletes: optional array of object { id }
id: string

Blocked sender pattern identifier.

formatuuid
patches: optional array of object { id, comments, created_at, 5 more }
id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
posts: optional array of object { id, comments, created_at, 5 more }
id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"
puts: optional array of object { id, comments, created_at, 5 more }
id: optional string

Blocked sender pattern identifier.

formatuuid
comments: optional string
maxLength1024
created_at: optional string
formatdate-time
is_regex: optional boolean

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: optional string

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

formatdate-time
modified_at: optional string
formatdate-time
pattern: optional string

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

maxLength1024
minLength1
pattern_type: optional "EMAIL" or "DOMAIN" or "IP" or "UNKNOWN"

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
One of the following:
"EMAIL"
"DOMAIN"
"IP"
"UNKNOWN"

Batch blocked sender operations

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/email-security/settings/block_senders/batch \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -d '{
          "deletes": [
            {
              "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
            }
          ],
          "patches": [
            {}
          ],
          "posts": [
            {
              "is_regex": false,
              "pattern": "test@example.com",
              "pattern_type": "EMAIL"
            }
          ],
          "puts": [
            {
              "is_regex": false,
              "pattern": "test@example.com",
              "pattern_type": "EMAIL"
            }
          ]
        }'
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "deletes": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
      }
    ],
    "patches": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ],
    "posts": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ],
    "puts": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ]
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "deletes": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
      }
    ],
    "patches": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ],
    "posts": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ],
    "puts": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "comments": "Block sender with email test@example.com",
        "created_at": "2014-01-01T05:20:00.12345Z",
        "is_regex": false,
        "last_modified": "2014-01-01T05:20:00.12345Z",
        "modified_at": "2014-01-01T05:20:00.12345Z",
        "pattern": "test@example.com",
        "pattern_type": "EMAIL"
      }
    ]
  }
}