Fetch refused writes

The most recent writes a list's write rules refused: what was attempted, which rule refused it and when. It's the first place to look when a client says something doesn't work.

The last 50 per list are kept, and older ones are dropped as new ones arrive. There's no item data and no token secret in the log.

GET https://api.jsonpad.io/lists/{listId}/rules/denials

This needs user auth mode, or a token with update permission on the list, the same as reading the rules themselves.

Parameters

required
listIdstringA list id or path name.

Response body

200 OK

{limit: 50
data: [0: {id: "f035b844-8557-422a-a1b9-996c258987bc"
createdAt: "2026-09-23T17:09:14.554Z"
updatedAt: "2026-09-23T17:09:14.554Z"
itemId: "c6fae7a3-84b0-4704-844d-d6812b38336c"
identityId: "eb7f2e70-da84-4963-adb5-9850e98c2e8a"
tokenId: "5d226e87-2a75-4255-b04f-ec8053ebaaae"
operation: "update"
stage: "allow"
statementIndex: 0
statementLabel: "your turn"
statementLine: 5
reason: null
}
]
}

limitnumberHow many refused writes are kept per list.
data[].operationstringcreate, update or delete.
data[].stagestringallow when nothing authorised the write (a 403), or require when it failed one of your checks (a 400).
data[].statementLabelnullable stringThe label of the rule that refused it, with statementIndex and statementLine. All three are null when no allow statement passed, because no single rule is to blame.
data[].reasonnullable stringThe message the client was given, for a failed require.
data[].itemIdnullable stringThe item the write was against, with identityId and tokenId for who made it. Each can be null.

Refused writes are also shown on the rules page in the dashboard, under the playground.

2026-09-23