POST /v1/admin/app-hosts/{label}/block
B3 operators only: takes address label down for good. It answers 410 to every visitor within seconds, stops serving its sandbox, and can be neither claimed again nor routed; its owner's next apply does not bring it back. Not behind the platform.app_hosts flag: B3 can block any address whatever its own organization's flag; only a key of a first-party organization may call it (403 forbidden otherwise).

Authentication

Bearer Token (b3os_sk_ API key or b3os_pat_ token)

Path Parameters

label string required path
The address's label, the part before .b3os.io.
Min length 1Max length 63Pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$
Example: "gpt-researcher"

Request Body required

application/json
reason string REQUIRED
Why, for the record (never shown to visitors).
Min length 1Max length 200

Responses

200 The blocked address.
application/json
object string REQUIRED
Values app_host
label string REQUIRED
An address's label, the part before .b3os.io.
url string (uri) REQUIRED
https://<label>.b3os.io.
app string REQUIRED
An application's name, the name in its b3os.yaml.
environment string REQUIRED
The environment (production; environments are projects in this beta).
project_id string REQUIRED
service string REQUIRED
The service of the application whose port this is.
port integer REQUIRED
access string REQUIRED
link: people who hold a link from b3os app link. public: anyone on the internet.
Values link public
cookies object REQUIRED
mode string REQUIRED
isolated: the app's server gets only the cookies its own address set, plus the names in script. shared: the browser's cookies pass, except Cloudflare's and B3OS's own names and values that are not plain (a space, comma, quote or backslash).
Values isolated shared
script string[] REQUIRED
Cookies a page script writes and the app's server reads, by name.
state string REQUIRED
claimed: the label is the port's and no deploy has switched it yet. serving: it serves sandbox_id. stopped: it serves nothing (b3os app down, or the organization or project stopped). blocked: B3 took it down; it can be neither claimed nor routed.
Values claimed serving stopped blocked
sandbox_id string | null REQUIRED
The sandbox the address serves (serving only).
deploy_id string | null REQUIRED
The deploy that last switched the address.
base_label string | null REQUIRED
The application's own label this one is derived from (<base>--<service>), or null.
primary boolean
The address of the application's primary port, which holds its own label (the others derive from it). Set when that port is first claimed; a later primary in b3os.yaml does not move it. Every answer of the edge has it.
blocked_reason string | null
Why B3 blocked the address (blocked only; else null). Every answer of the edge has it.
claimed_at string (date-time) REQUIRED
updated_at string (date-time) REQUIRED
dropped_cookies object[] REQUIRED
Cookies a page script set that the address did not pass to the app in the last 7 days (cookies: isolated), by name, most requests first. List one under cookies.script to let it through.
Array of:
name string REQUIRED
requests integer REQUIRED
400 The request failed validation (invalid_request, invalid_url).
401 Missing, malformed, expired or revoked credentials (unauthorized).
403 Authenticated but not allowed (forbidden, egress_denied).
404 No such address in your project and application (app_host_not_found), or addresses are not on for your organization (feature_not_enabled: the platform.app_hosts flag).
413 The request body exceeds this operation's limit.
415 The Content-Type is not accepted by this operation.
429 A rate, concurrency or quota limit applies (rate_limited, concurrency_limited, quota_exceeded).
500 Something failed inside B3OS (internal). Retry with backoff.
503 The node or the product is not available right now (node_unavailable, product_unavailable, capacity_unavailable).
curl -X POST 'https://beta-api.b3os.org/v1/admin/app-hosts/gpt-researcher/block' \  -H 'Authorization: Bearer YOUR_API_TOKEN' \  -H 'Content-Type: application/json' \  -d '{  "reason": "phishing page reported on 2026-11-11"}'
const response = await fetch('https://beta-api.b3os.org/v1/admin/app-hosts/gpt-researcher/block', {  method: 'POST',  headers: {      "Authorization": "Bearer YOUR_API_TOKEN",      "Content-Type": "application/json"  },  body: JSON.stringify({    "reason": "phishing page reported on 2026-11-11"  })});const data = await response.json();console.log(data);
import requestsheaders = {    'Authorization': 'Bearer YOUR_API_TOKEN'}response = requests.post('https://beta-api.b3os.org/v1/admin/app-hosts/gpt-researcher/block', headers=headers, json={  "reason": "phishing page reported on 2026-11-11"})print(response.json())
200 Response
{  "object": "app_host",  "label": "gpt-researcher",  "url": "https://gpt-researcher.b3os.io",  "app": "gpt-researcher",  "environment": "production",  "project_id": "prj_01m5t3pf8heewxt65ej3dm577y",  "service": "web",  "port": 8000,  "access": "link",  "cookies": {    "mode": "isolated",    "script": []  },  "state": "blocked",  "sandbox_id": null,  "deploy_id": "dep_01m6a2zq8x9hkqd3n7c5b4v2tw",  "base_label": null,  "primary": true,  "blocked_reason": "phishing page reported on 2026-11-11",  "claimed_at": "2026-11-11T09:00:00.000Z",  "updated_at": "2026-11-11T10:00:00.000Z",  "dropped_cookies": []}
Ask a question... ⌘I