# `POST /v1/lists` — Block or allow one value

A blocked value declines a verification that presents it (LIST_BLOCK; a workflow can send it to review instead). An allowed value skips the velocity, IP-country and risky-contact holds. The value is normalized first (emails lower-cased, phones as E.164, IPs and CIDR ranges, two-letter countries); adding an active value returns the existing entry with 200. An expired matching entry is reactivated with the requested expiry and returned with 200. Needs the lists:write scope.

Body:
- `kind` (string, required) One of `block`, `allow`.
- `type` (string, required): installation is the device id from a verification report; vendor_data is your id for the person; country is the document's issuing country (ISO alpha-2). One of `email`, `phone`, `ip`, `installation`, `vendor_data`, `country`.
- `value` (string, required): For ip, an address or a CIDR range.
- `reason` (string)
- `expires_at` (string, nullable): Must be in the future.

Responses:
- 200: Already listed; the existing entry.
- 201: Added.
- 400: Invalid value, or an expiry that is not in the future.
- 401: Missing, unknown or expired API key.
- 403: The key lacks the scope this call needs, or its IP allowlist refuses the caller.
- 429: More than 300 list calls in a minute.
- 503: Lists are not available right now.