Security — entry 009 of 30
FilterLists
FilterLists is Collin Barrett's independent, actively-maintained directory of filter and host lists used by adblockers, firewalls, and DNS sinkholes to block ads, trackers, malware, and other unwanted content. Its ASP.NET Core REST API serves the same catalog that powers the site -- filter lists, the domains/URLs they target, licenses, and maintainer info -- with an interactive Swagger UI for exploring the schema before writing a query. The API and site are fully free and keyless, open-sourced on GitHub with commits as recent as this week. The API lives entirely on a separate `api.filterlists.com` host -- the intuitive REST paths on the main `filterlists.com` domain just return the site's own SPA shell.
FilterLists catalogs the filter and host lists that adblockers, firewalls, and DNS sinkholes subscribe to. The API lives entirely on a separate api. subdomain from the site you'd naturally reach for docs — /lists returns the full catalog as one flat array, and /lists/{id} returns one entry's much richer detail record.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/filterlists/"><img src="https://greatapis.com/badge/filterlists.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key or account is required — every endpoint below is a public, keyless read, confirmed live.
- Use
api.filterlists.com, notfilterlists.com. Confirmed live in this run: bothhttps://filterlists.com/api/v1/listsandhttps://filterlists.com/api/directory/lists— URLs that look like the natural REST path from the site's own domain — return200 text/html, the site's own SPA shell, not API data. The real API only responds onhttps://api.filterlists.com.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Fetch one filter list's full detail record
GEThttps://api.filterlists.com/lists/1
{"id":1,"name":"AdGuard Japanese filter Plus","description":"This complements AdGuard Japanese filter and mainly consists of 1) additional generic rules to counter circumvention ads and anti-adblock, and 2) specific rules to address sites not addresed in the Japanese filters.","licenseId":4,"syntaxIds":[4],"languageIds":[73],"tagIds":[2],"viewUrls":[{"segmentNumber":1,"primariness":1,"url":"https://raw.githubusercontent.com/Yuki2718/adblock2/main/japanese/jpf-plus.txt"}],"homeUrl":"https://github.com/Yuki2718/adblock2","onionUrl":null,"policyUrl":null,"submissionUrl":null,"issuesUrl":"https://github.com/Yuki2718/adblock2/issues","forumUrl":null,"chatUrl":null,"emailAddress":null,"donateUrl":null,"maintainerIds":[150],"upstreamFilterListIds":[],"forkFilterListIds":[],"includedInFilterListIds":[],"includesFilterListIds":[],"dependencyFilterListIds":[],"dependentFilterListIds":[]}Captured live and unmodified — list ID 1 happens to be the first row returned by /lists at probe time, not a curated pick.
Developer reference
https://api.filterlists.comGotchas & limits
- The API is on a different host from both the site's own URL and its docs URL. Confirmed live:
filterlists.com/api/v1/listsandfilterlists.com/api/directory/listsboth 200 withtext/html(the SPA shell, 2,295 bytes), whileapi.filterlists.com/lists200s with realapplication/json. /lists(the index) returns every one of the catalog's 2,306 entries in a single, unpaginated 577 KB JSON array — confirmed live, no page/limit/offset parameter is accepted or documented. Fetch a single entry via/lists/{id}(as in the worked example) rather than the whole index if you only need one.- The index entry and the single-item detail are genuinely different shapes, not just a trimmed/full version of the same object. Confirmed live: a
/listsrow for list 1 carries only 8 fields (id, name, description, licenseId, syntaxIds, languageIds, tagIds, maintainerIds), while/lists/1adds ten more — viewUrls, homeUrl, onionUrl, policyUrl, submissionUrl, issuesUrl, forumUrl, chatUrl, emailAddress, donateUrl — plus six relationship-ID arrays (upstream/fork/includedIn/includes/dependency/dependent FilterListIds) not present on the index row at all — 24 keys on the detail record against 8 on the index row, the 16 extras being those ten fields plus these six. - An unknown
/lists/{id}(confirmed live with/lists/999999999) returns a bare404with an empty body (content-length: 0), not a JSON error object. - No CORS support: confirmed live,
/lists/1returns noaccess-control-allow-originheader at all, whether the request is bare or carries anOrigin: https://example.comheader — matches this entry's storedcors: no. - Sibling reference endpoints exist alongside
/listsfor resolving the ID arrays above:/languages(78 entries, confirmed live, e.g.{"id":4,"iso6391":"af","name":"Afrikaans"}),/tags(41 entries), and/software.