Skip to content

Block multiple items

POST/settings/blocked-addresses/bulk

Endpoint API · Blocked Addresses

Allows the user to specify multiple IP addresses or IP address ranges that devices should refuse to communicate with. This feature is only available on Windows devices.

Required permissionblocked-ips:write

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.

Request body

Content type: application/json

Request body fields

itemsarray of objectrequired
Must contain at most 100 items.
Request to block a single IP address or IP address range.
Show child attributesHide child attributes
itemstringrequired
A single IP address or an IP address range. The IP can be IPv4 or IPv6 and the range can be specified using a dash or in CIDR format.
commentstring
Comment indicating why the IP address or IP address range should be blocked.
Must be at most 250 characters long.
expireInDaysinteger
Duration (in days) for which the IP address or IP address range should be blocked. Any decimal values are rounded down to an integer.
Must be ≥ 1 and ≤ 365.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/blocked-addresses/bulk" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"items\": [
    {
      \"item\": [
        \"1.1.2.3\",
        \"1.2.2.3/17\",
        \"1.3.2.3-1.3.2.6\",
        \"2001:db8:3333:4444:5555:6666:7777:8888\",
        \"2001:4860:4860::8888/32\",
        \"2001:db8:3333:4444:5555:6666:7777:8888-2001:db8:3333:4444:5555:6666:7777:9999\"
      ],
      \"comment\": \"string\",
      \"expireInDays\": 0
    }
  ]
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/blocked-addresses/bulk",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'items': [   {   'item': [   '1.1.2.3',
                                 '1.2.2.3/17',
                                 '1.3.2.3-1.3.2.6',
                                 '2001:db8:3333:4444:5555:6666:7777:8888',
                                 '2001:4860:4860::8888/32',
                                 '2001:db8:3333:4444:5555:6666:7777:8888-2001:db8:3333:4444:5555:6666:7777:9999'],
                     'comment': 'string',
                     'expireInDays': 0}]},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "items": [
    {
      "item": [
        "1.1.2.3",
        "1.2.2.3/17",
        "1.3.2.3-1.3.2.6",
        "2001:db8:3333:4444:5555:6666:7777:8888",
        "2001:4860:4860::8888/32",
        "2001:db8:3333:4444:5555:6666:7777:8888-2001:db8:3333:4444:5555:6666:7777:9999"
      ],
      "comment": "string",
      "expireInDays": 0
    }
  ]
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/blocked-addresses/bulk" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/blocked-addresses/bulk", strings.NewReader(`{
  "items": [
    {
      "item": [
        "1.1.2.3",
        "1.2.2.3/17",
        "1.3.2.3-1.3.2.6",
        "2001:db8:3333:4444:5555:6666:7777:8888",
        "2001:4860:4860::8888/32",
        "2001:db8:3333:4444:5555:6666:7777:8888-2001:db8:3333:4444:5555:6666:7777:9999"
      ],
      "comment": "string",
      "expireInDays": 0
    }
  ]
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/settings/blocked-addresses/bulk", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "items": [
    {
      "item": [
        "1.1.2.3",
        "1.2.2.3/17",
        "1.3.2.3-1.3.2.6",
        "2001:db8:3333:4444:5555:6666:7777:8888",
        "2001:4860:4860::8888/32",
        "2001:db8:3333:4444:5555:6666:7777:8888-2001:db8:3333:4444:5555:6666:7777:9999"
      ],
      "comment": "string",
      "expireInDays": 0
    }
  ]
}),
});
const data = await response.json();
console.log(data);

Responses

201 — Newly blocked IP addresses or IP address ranges.

Response fields

itemsarray of object
A blocked IP address or IP range.
Show child attributesHide child attributes
idstring (uuid)
The identifier of the blocked IP address or IP range record.
itemstring
A single IP address or an IP range. The IP can be IPv4 or IPv6 and the range can be specified using a dash or in CIDR format.
commentstring
Comment indicating why the IP address or IP range should be blocked.
Must be at most 250 characters long.
createdAtstring (date-time)
When the IP address or IP range was set to be blocked.
blockedUntilstring (date-time)
The time until which the IP address or IP range will be blocked, in ISO-8601 format.
createdByobject
Show child attributesHide child attributes
idstringrequired
Principal Email or clientId.
typestring (enum)required
Principal type.
Must be one of: user, service, system.
namestring
User Principal name.
accountTypestring
Account type.
Must be one of: partner, tenant, organization.
accountIdstring (uuid)
Account ID.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Can't find customer.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

201

{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "item": "string",
      "comment": "string",
      "createdAt": "2026-07-28T00:00:00Z",
      "blockedUntil": "2026-07-28T00:00:00Z",
      "createdBy": {
        "id": "string",
        "type": "user",
        "name": "string",
        "accountType": "partner",
        "accountId": "00000000-0000-0000-0000-000000000000"
      }
    }
  ]
}

See the guide for a narrative walkthrough of this API.