curl -X POST https://api.liddie.io/api/v1/whitelist/665f.../delete \
-H "Cookie: <dashboard session cookies>" \
-H "Content-Type: application/json" \
-d '{}'
// Dashboard-session auth: send the session JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/whitelist/665f.../delete', {
method: 'POST',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
// include one fresh MFA factor (email code, OTP, or passkey assertion)
body: JSON.stringify({}),
})
const body = await res.json()
Whitelist
Remove whitelist entry
Remove a whitelisted crypto wallet address or withdrawal IP from your Liddie account whitelist by id, verified with a fresh MFA factor for security.
POST
/
api
/
v1
/
whitelist
/
{id}
/
delete
curl -X POST https://api.liddie.io/api/v1/whitelist/665f.../delete \
-H "Cookie: <dashboard session cookies>" \
-H "Content-Type: application/json" \
-d '{}'
// Dashboard-session auth: send the session JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/whitelist/665f.../delete', {
method: 'POST',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
// include one fresh MFA factor (email code, OTP, or passkey assertion)
body: JSON.stringify({}),
})
const body = await res.json()
Removes a whitelist entry — a wallet address or a withdrawal IP — by its id. You can find the ids via Get whitelist.
Cookie-authenticated writes also need an
Origin header. Any non-GET request that carries the liddie_access session cookie is checked against the allowed dashboard origins; a bare cURL that sends only the cookie is rejected with 403 {"ok":false,"error":{"code":"CSRF_ORIGIN_MISMATCH","message":"Forbidden"}} before the handler runs. The snippet below is shown for shape — from a browser the dashboard sends the origin for you; from a script, prefer an API key where the endpoint accepts one.curl -X POST https://api.liddie.io/api/v1/whitelist/665f.../delete \
-H "Cookie: <dashboard session cookies>" \
-H "Content-Type: application/json" \
-d '{}'
// Dashboard-session auth: send the session JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/whitelist/665f.../delete', {
method: 'POST',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
// include one fresh MFA factor (email code, OTP, or passkey assertion)
body: JSON.stringify({}),
})
const body = await res.json()
Authorization
Dashboard-only (JWT session). Roles:merchant_admin / merchant_member / super_admin, with team permission whitelist:manage. The body must additionally carry a fresh MFA factor (passkey / TOTP / emailed code); request an email code via Send whitelist email code. Rate limit: 10/min.
Calling with an API key fails with 401 {"error":"Invalid or expired token"} — the key is not a JWT.
Parameters
string
required
The whitelist entry id (from Get whitelist).
MFA fields (dashboard sessions)
MFA fields (dashboard sessions)
string
The single-use emailed code.
string
A 6-digit code from your authenticator app — an alternative to
emailCode. Backup codes are not accepted here: the field is validated against ^[0-9]{6}$ and backup codes are 16 hexadecimal characters. They work only at login (POST /2fa/validate). If you have lost your authenticator, request an emailed code instead.object
WebAuthn assertion, used together with
challengeKey.string
Accompanies
passkeyResponse.Request a fresh single-use code via Send whitelist email code right before this call, then include it in the body as the email-code verification factor — alternatively, an OTP or passkey assertion satisfies the MFA requirement.
Response
200 OK.
200 OK
{ "ok": true, "data": { "deleted": true } }
Errors
| Status | Body | Why |
|---|---|---|
| 400 | {"ok":false,"error":{"code":"INVALID_ID","message":"Invalid ID format"}} | The entryId path parameter is not a valid id. |
| 400 | {"ok":false,"error":{"code":"VERIFICATION_FAILED","message":"Verification required: provide email code, OTP, or passkey"}} | No (or invalid) MFA factor in the body. |
| 401 | {"ok":false,"error":{"code":"VERIFICATION_FAILED","message":"Invalid email code"}} | Wrong, already-used or invalid email code, OTP or passkey assertion. Same code, different status — do not treat this 401 as an expired session. |
| 403 | {"ok":false,"error":{"code":"VERIFICATION_FAILED","message":"TOTP is not enabled on this account"}} | A totpCode was sent by a user with no authenticator enrolled. |
| 429 | {"ok":false,"error":{"code":"VERIFICATION_FAILED","message":"Too many incorrect codes. Request a new one."}} | Five wrong email codes — the challenge is voided; request a fresh code. |
| 429 | {"ok":false,"error":{"code":"VERIFICATION_FAILED","message":"Too many failed attempts. Try again later."}} | TOTP lockout after repeated wrong codes. |
| 404 | {"ok":false,"error":{"code":"WHITELIST_REMOVE_FAILED","message":"Whitelist entry not found"}} | No entry with that id on this merchant’s whitelist (unknown, already removed, or another merchant’s). |
| 401 | {"error":"Invalid or expired token"} | Called with an API key (or an expired session) — this endpoint is dashboard-JWT only. |
See also
- Get whitelist: list the entries (and their ids) currently on the whitelist.
- Add wallet address: add a withdrawal destination back to the whitelist.
- Send whitelist email code: get the single-use email code this endpoint accepts as an MFA factor.