Lists

The Lists API lets you manage typed lists for your application. System blocklists are automatically created and checked during verification and transaction screening. You can also create allowlists and custom lists for workflow conditions.

​

Concepts

​

Entry types

​

Allowlists

Allowlists do not override blocklists or authenticity checks. They only suppress duplicate/reuse actions for the same entry type. For example, a face in a face allowlist can skip the DUPLICATED_FACE action, an IP in an IP allowlist can skip the DUPLICATED_IP_ADDRESS action, and a device fingerprint in a device allowlist can skip the DUPLICATED_DEVICE_FINGERPRINT action. Didit still records an informational allowlist warning so you can audit why the duplicate action did not run.

​

System blocklists

Every application automatically gets 10 system blocklists (one per supported entry type). These cannot be deleted or renamed. You can add entries to them via the API or from the console.

​

Traceability

Every blocklist entry can be linked back to its source entity so you can navigate from the list to the original record:

• From a session — pass reference_session_id when creating an entry. Didit auto-extracts the value (face, document, phone, email, IP, or device), marks the underlying model as blocklisted, and links the entry back to the session. If the session has multiple instances of the same type, also pass value to disambiguate.
• From a transaction, user, or business — pass reference_object_uuid with the entity’s UUID and include metadata.reference_type ("transaction", "vendor_user", or "vendor_business") so the console can link back to the original record.

​

Endpoints