Use Curated Blocklists in Tenant Access Control Lists

This feature is available for Attack Protection customers.

Curated Blocklists extend Auth0 Tenant Access Control Lists (ACLs) with dynamically updated threat intelligence lists maintained by Auth0. Instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), you can reference pre-defined curated categories in your Network ACL rules. When traffic matches any entry in an enabled curated list, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request.

Available curated lists

Auth0 organizes curated lists into broad categories using standard naming conventions. All curated lists use the auth0.<category> prefix:

List identifier	Category	Description
`auth0.low_reputation`	Low Reputation IPs	High-risk IP addresses identified by Auth0 threat intelligence, such as active threat vectors or high-risk origin points.
`auth0.icloud_relay_proxy`	Apple Private Relay	Traffic originating from Apple iCloud Private Relay egress nodes.

Configure rules with curated lists

Configure curated lists using the auth0_managed matcher in the Network ACLs Management API inside a rule definition.

Block traffic from curated lists

To block traffic from low-reputation IPs at the authentication endpoint, send a POST request to /api/v2/network-acls:

{
  "description": "Block low-reputation IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation"
      ]
    },
    "scope": "authentication"
  }
}

Combine with other matchers

Curated lists can be combined with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule:

{
  "description": "Block specific regions and curated threat IPs",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation",
        "auth0.icloud_relay_proxy"
      ],
      "geo_country_codes": [
        "CN"
      ]
    },
    "scope": "authentication"
  }
}

Exclude curated list traffic

Use not_match to explicitly allow traffic that is not on a curated list, for example to allowlist clean traffic while a broader blocking rule is in effect:

{
  "description": "Allow traffic not flagged as low reputation",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "not_match": {
      "auth0_managed": ["auth0.low_reputation"]
    },
    "scope": "authentication"
  }
}

Key capabilities

Automated updates: Auth0 Threat Intelligence continuously updates all auth0.* list feeds, requiring no manual rule updates on your end.
Unified matching: The auth0_managed matcher handles underlying complexity — such as mixing IPv4, IPv6, and TLS fingerprints — transparently within a single array.

Protect Your Application

Call APIs On User's Behalf

Protect Your Tenant

Compliance

Use Curated Blocklists in Tenant Access Control Lists

Available curated lists

Configure rules with curated lists

Block traffic from curated lists

Combine with other matchers

Exclude curated list traffic

Key capabilities

Learn more

​Available curated lists

​Configure rules with curated lists

​Block traffic from curated lists

​Combine with other matchers

​Exclude curated list traffic

​Key capabilities

​Learn more

Available curated lists

Configure rules with curated lists

Block traffic from curated lists

Combine with other matchers

Exclude curated list traffic

Key capabilities

Learn more