# `POST /v1/lists/bulk` — Block or allow up to 1000 values at once

Each entry is checked like a single add. Invalid entries and repeats within the request are reported per entry and not stored; new entries are added and expired matches are reactivated with the requested expiry. Active matches remain unchanged. Counts and per-entry statuses distinguish created, reactivated and existing entries. Changes and their audit record are saved atomically. Needs the lists:write scope.

Body:
- `entries` (array of NewListEntry, required)
  - `kind` (string, required) One of `block`, `allow`.
  - `type` (string, required): installation is the device id from a verification report; vendor_data is your id for the person; country is the document's issuing country (ISO alpha-2). One of `email`, `phone`, `ip`, `installation`, `vendor_data`, `country`.
  - `value` (string, required): For ip, an address or a CIDR range.
  - `reason` (string)
  - `expires_at` (string, nullable): Must be in the future.

Responses:
- 200: What happened to each entry, by its position in the request.
- 400: The body is not an object with 1 to 1000 entries.
- 401: Missing, unknown or expired API key.
- 403: The key lacks the scope this call needs, or its IP allowlist refuses the caller.
- 429: More than 300 list calls in a minute.
- 503: Lists are not available right now.