> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-acl-curated-blocklist.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Curated Blocklists in Tenant Access Control Lists

> Use Auth0-managed curated IP blocklists in Tenant ACL rules to automatically block known threats without manually maintaining IP ranges or ASNs.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  This feature is available for **Attack Protection** customers.
</Callout>

Curated Blocklists extend Auth0 [Tenant Access Control Lists (ACLs)](/docs/secure/tenant-access-control-list) with dynamically updated threat intelligence lists maintained by Auth0. Instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), you can reference pre-defined curated categories in your Network ACL rules.

When traffic matches any entry in an enabled curated list, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request.

## Available curated lists

Auth0 organizes curated lists into broad categories using standard naming conventions. All curated lists use the `auth0.<category>` prefix:

| List identifier            | Category            | Description                                                                                                               |
| -------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `auth0.low_reputation`     | Low Reputation IPs  | High-risk IP addresses identified by Auth0 threat intelligence, such as active threat vectors or high-risk origin points. |
| `auth0.icloud_relay_proxy` | Apple Private Relay | Traffic originating from Apple iCloud Private Relay egress nodes.                                                         |

## Configure rules with curated lists

Configure curated lists using the `auth0_managed` matcher in the [Network ACLs Management API](/docs/api/management/v2) inside a rule definition.

### Block traffic from curated lists

To block traffic from low-reputation IPs at the authentication endpoint, send a `POST` request to `/api/v2/network-acls`:

```json theme={null}
{
  "description": "Block low-reputation IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation"
      ]
    },
    "scope": "authentication"
  }
}
```

### Combine with other matchers

Curated lists can be combined with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule:

```json theme={null}
{
  "description": "Block specific regions and curated threat IPs",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation",
        "auth0.icloud_relay_proxy"
      ],
      "geo_country_codes": [
        "CN"
      ]
    },
    "scope": "authentication"
  }
}
```

### Exclude curated list traffic

Use `not_match` to explicitly allow traffic that is not on a curated list, for example to allowlist clean traffic while a broader blocking rule is in effect:

```json theme={null}
{
  "description": "Allow traffic not flagged as low reputation",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "not_match": {
      "auth0_managed": ["auth0.low_reputation"]
    },
    "scope": "authentication"
  }
}
```

## Key capabilities

* **Automated updates**: Auth0 Threat Intelligence continuously updates all `auth0.*` list feeds, requiring no manual rule updates on your end.
* **Unified matching**: The `auth0_managed` matcher handles underlying complexity — such as mixing IPv4, IPv6, and TLS fingerprints — transparently within a single array.

## Learn more

* [Configure Tenant Access Control List Rules](/docs/secure/tenant-access-control-list/configure-rules)
* [Rule Evaluation](/docs/secure/tenant-access-control-list/rule-evaluation)
* [Management API Parameter Reference](/docs/secure/tenant-access-control-list/reference)