Security — entry 009 of 30
FilterLists
FilterLists is Collin Barrett's independent, actively-maintained directory of filter and host lists used by adblockers, firewalls, and DNS sinkholes to block ads, trackers, malware, and other unwanted content. Its ASP.NET Core REST API serves the same catalog that powers the site -- filter lists, the domains/URLs they target, licenses, and maintainer info -- with an interactive Swagger UI for exploring the schema before writing a query. The API and site are fully free and keyless, open-sourced on GitHub with commits as recent as this week. The API lives entirely on a separate `api.filterlists.com` host -- the intuitive REST paths on the main `filterlists.com` domain just return the site's own SPA shell.
FilterLists catalogs the filter and host lists that adblockers, firewalls, and DNS sinkholes subscribe to. The API lives entirely on a separate `api.` subdomain from the site you'd naturally reach for docs -- `/lists` returns the full catalog as one flat array, and `/lists/{id}` returns one entry's much richer detail record.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/filterlists/"><img src="https://greatapis.com/badge/filterlists.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key or account is required -- every endpoint below is a public, keyless read, confirmed live.
- Use `api.filterlists.com`, not `filterlists.com`. Confirmed live in this run: both `https://filterlists.com/api/v1/lists` and `https://filterlists.com/api/directory/lists` -- URLs that look like the natural REST path from the site's own domain -- return `200 text/html`, the site's own SPA shell, not API data. The real API only responds on `https://api.filterlists.com`.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Fetch one filter list's full detail record
GEThttps://api.filterlists.com/lists/1
{"id":1,"name":"AdGuard Japanese filter Plus","description":"This complements AdGuard Japanese filter and mainly consists of 1) additional generic rules to counter circumvention ads and anti-adblock, and 2) specific rules to address sites not addresed in the Japanese filters.","licenseId":4,"syntaxIds":[4],"languageIds":[73],"tagIds":[2],"viewUrls":[{"segmentNumber":1,"primariness":1,"url":"https://raw.githubusercontent.com/Yuki2718/adblock2/main/japanese/jpf-plus.txt"}],"homeUrl":"https://github.com/Yuki2718/adblock2","onionUrl":null,"policyUrl":null,"submissionUrl":null,"issuesUrl":"https://github.com/Yuki2718/adblock2/issues","forumUrl":null,"chatUrl":null,"emailAddress":null,"donateUrl":null,"maintainerIds":[150],"upstreamFilterListIds":[],"forkFilterListIds":[],"includedInFilterListIds":[],"includesFilterListIds":[],"dependencyFilterListIds":[],"dependentFilterListIds":[]}Captured live and unmodified -- list ID 1 happens to be the first row returned by /lists at probe time, not a curated pick.
Developer reference
https://api.filterlists.comGotchas & limits
- The API is on a different host from both the site's own URL and its docs URL. Confirmed live: `filterlists.com/api/v1/lists` and `filterlists.com/api/directory/lists` both 200 with `text/html` (the SPA shell, 2,295 bytes), while `api.filterlists.com/lists` 200s with real `application/json`.
- `/lists` (the index) returns every one of the catalog's 2,306 entries in a single, unpaginated 577 KB JSON array -- confirmed live, no page/limit/offset parameter is accepted or documented. Fetch a single entry via `/lists/{id}` (as in the worked example) rather than the whole index if you only need one.
- The index entry and the single-item detail are genuinely different shapes, not just a trimmed/full version of the same object. Confirmed live: a `/lists` row for list 1 carries only 8 fields (id, name, description, licenseId, syntaxIds, languageIds, tagIds, maintainerIds), while `/lists/1` adds ten more -- viewUrls, homeUrl, onionUrl, policyUrl, submissionUrl, issuesUrl, forumUrl, chatUrl, emailAddress, donateUrl -- plus six relationship-ID arrays (upstream/fork/includedIn/includes/dependency/dependent FilterListIds) not present on the index row at all -- 24 keys on the detail record against 8 on the index row, the 16 extras being those ten fields plus these six.
- An unknown `/lists/{id}` (confirmed live with `/lists/999999999`) returns a bare `404` with an empty body (`content-length: 0`), not a JSON error object.
- No CORS support: confirmed live, `/lists/1` returns no `access-control-allow-origin` header at all, whether the request is bare or carries an `Origin: https://example.com` header -- matches this entry's stored `cors: no`.
- Sibling reference endpoints exist alongside `/lists` for resolving the ID arrays above: `/languages` (78 entries, confirmed live, e.g. `{"id":4,"iso6391":"af","name":"Afrikaans"}`), `/tags` (41 entries), and `/software`.