> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Remove from Blocklist > POST /v3/blocklist/remove/: lift the block on the face, document, phone number or email of a Didit verification session in one call. Remove from Blocklist API Prompt Copy prompt to clipboard \

\`Lift the block on the face, document, phone number or email address of one of my Didit verification sessions through the Management API.

Endpoint:
POST https://verification.didit.me/v3/blocklist/remove/

Authentication:
Use the x-api-key header with my Didit API key. A scoped API key needs workflows: write.

Goal:
\- Undo a blocklist decision for a session, for example after a false positive.

Request body (application/json):
\{
"session_id": "33333333-4444-5555-6666-777777777777", // required: a verification session of my application
"unblock_face": true,       // optional, default false
"unblock_document": true,   // optional, default false
"unblock_phone": false,     // optional, default false
"unblock_email": false      // optional, default false
}
At least one unblock_* flag must be true.

Behavior:
\- Didit uses the session's most recent record of each selected type.
\- The record is no longer flagged as blocklisted, and the system blocklist entries created from it are deleted, so it no longer declines new sessions.
\- Entries added by value are not touched: if the same phone number was also added to the phone blocklist by hand, it stays blocked until I delete that entry with DELETE /v3/lists/{list_uuid}/entries/{entry_uuid}/.
\- Unblocking a record that is not blocklisted succeeds and changes nothing.
\- Sessions that already finished are not changed.

Example call:
curl -X POST "https://verification.didit.me/v3/blocklist/remove/" \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"session_id": "33333333-4444-5555-6666-777777777777", "unblock_face": true, "unblock_document": true}'

Example response (200):
\{ "message": "Successfully removed from blocklist." }

Failure modes:
\- 400: session_id is missing ({ "session_id": ["This field is required."] }) or not a UUID ({ "session_id": ["Must be a valid UUID."] }); the session is not a verification session of this application ({ "non_field_errors": ["Session not found"] }; business verification sessions are not accepted); no flag is true ({ "non_field_errors": ["Must specify at least one item to unblock"] }); or the session has no record of a selected type ({ "non_field_errors": ["Session does not have an email record"] }).
\- 401: the API key has expired.
\- 403: missing or invalid x-api-key ({ "detail": "You do not have permission to perform this action." }), or a scoped key without workflows: write.
\- 429: rate limited (see /integration/rate-limiting); back off and retry.

Side effects:
\- Deletes the matching entries from the system face, document, phone and email blocklists.

For the full integration shape, see /integration/integration-prompt.`

\
Paste into Lift the block on what one verification session collected: its face, identity document, phone number or email address. The record is no longer flagged as blocklisted and the system blocklist entries created from it are deleted, so it no longer declines new sessions.> [!NOTE] > > Only entries created from the session's records are removed. A value someone added to a list by hand, such as the same phone number typed into the phone blocklist, stays blocked: find it with [List entries](/management-api/lists/list-entries.md) and remove it with [Delete entry](/management-api/lists/delete-entry.md).To see what is currently blocked, use [List blocklisted items](/management-api/blocklist/list.md). See [Blocklist users](/console/blocklist-users.md) for managing the blocklist in the console. ## OpenAPI ````yaml POST /v3/blocklist/remove/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/blocklist/remove/: post: tags: - Blocklist summary: Remove session items from the blocklist description: >- Lifts the block on the face, identity document, phone number or email address of one person verification session of the application. For each selected type, Didit takes the session's most recent record, clears its blocklisted flag and deletes the system blocklist entries created from that record, so it no longer declines new sessions. Entries added to a list by value are not touched: find them with [List list entries](https://docs.didit.me/management-api/lists/list-entries) and delete them with [Delete a list entry](https://docs.didit.me/management-api/lists/delete-entry). Unblocking a record that is not blocklisted succeeds and changes nothing, and sessions that already finished are not changed. A scoped API key needs `workflows: write`. operationId: remove_from_blocklist requestBody: required: true content: application/json: schema: type: object required: - session_id description: At least one `unblock_*` flag must be `true`. properties: session_id: type: string format: uuid description: >- A person verification session of your application. Deleted sessions are refused. unblock_face: type: boolean default: false description: Lift the block on the session's face. unblock_document: type: boolean default: false description: Lift the block on the session's identity document. unblock_phone: type: boolean default: false description: Lift the block on the session's phone number. unblock_email: type: boolean default: false description: Lift the block on the session's email address. examples: Face and document: value: session_id: 33333333-4444-5555-6666-777777777777 unblock_face: true unblock_document: true responses: '200': description: The block on the selected items was lifted. content: application/json: schema: type: object required: - message properties: message: type: string description: Always `Successfully removed from blocklist.` examples: Unblocked: value: message: Successfully removed from blocklist. '400': description: >- The body is invalid, the session is not a verification session of this application, or it has no record of a selected type. Nothing was changed. content: application/json: examples: Unknown session: value: non_field_errors: - Session not found No item selected: value: non_field_errors: - Must specify at least one item to unblock No email record: value: non_field_errors: - Session does not have an email record Invalid session id: value: session_id: - Must be a valid UUID. Missing session id: value: session_id: - This field is required. '401': description: >- The scoped API key has expired. Other authentication failures return `403`. content: application/json: examples: Expired API key: value: detail: This API key has expired. '403': description: >- The `x-api-key` header is missing or invalid, or a scoped API key lacks `workflows: write` or is used from an IP address outside its allowlist. content: application/json: examples: Missing or invalid API key: value: detail: You do not have permission to perform this action. Scoped key without workflows access: value: detail: This API key has no write access to workflows. '429': $ref: '#/components/responses/RateLimitedWrite' security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: |- curl -X POST 'https://verification.didit.me/v3/blocklist/remove/' \ -H 'x-api-key: YOUR_API_KEY' \ -H 'Content-Type: application/json' \ -d '{ "session_id": "33333333-4444-5555-6666-777777777777", "unblock_face": true, "unblock_document": true }' - lang: python label: Python source: |- import os import requests resp = requests.post( 'https://verification.didit.me/v3/blocklist/remove/', headers={'x-api-key': os.environ['DIDIT_API_KEY']}, json={ 'session_id': '33333333-4444-5555-6666-777777777777', 'unblock_face': True, 'unblock_document': True, }, timeout=10, ) resp.raise_for_status() print(resp.json()['message']) - lang: javascript label: JavaScript source: >- const resp = await fetch('https://verification.didit.me/v3/blocklist/remove/', { method: 'POST', headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ session_id: '33333333-4444-5555-6666-777777777777', unblock_face: true, unblock_document: true, }), }); if (!resp.ok) throw new Error(`Unblock failed: ${resp.status} ${await resp.text()}`); console.log((await resp.json()).message); components: responses: RateLimitedWrite: description: >- The shared write limit of 300 requests per minute per API key was exceeded. Honor `Retry-After` before retrying. content: application/json: schema: type: object required: - detail properties: detail: type: string example: detail: >- Write request rate limit exceeded. You can make up to 300 requests per minute. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.