To list all blacklist entries, an HTTP GET should be sent to the URI:

/api/oper/blacklist

The GET has only a single optional parameter with is alert_type. The alert_type restricts the listed entries to a particular source. All blacklist entries added using the REST API will have an alert_type value of "REST". If the alert_type parameter is not specified then all entries will be retrieved.

For example, to retrieve all entries created by the REST API then the alert-type filter should be set to the value "REST":

/api/oper/blacklist?alert_type=REST

All the possible values for the parameter alert_type can be found under the -alerttype option in the section for the command blacklist in the separate cOS Core CLI Reference Guide. It should be noted that the value "ALL" is not a valid alert_type with the REST API but this is the default if the alert_type parameter is not specified.

cOS Core will send back its reply to a GET in JSON format. Below is an example of a typical reply:

{
  "error": false,
  "blacklist_count": 2,
  "blacklist_hosts": [
    {
      "host": "203.0.113.5",
      "service": "",
      "ttl": "300",
      "alert_type": "REST",
      "rule_name": "-",
      "description": "api added"
    },
    {
      "host": "203.0.113.7",
      "service": "http-all",
      "ttl": "100",
      "alert_type": "REST",
      "rule_name": "-",
      "description": "api added"
    }
  ]
}