# Manage chat group allow list (/en/api-reference/api-ref/im/chat-group-management/manage-group-allowlist)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

A group allow list refers to a list of group members that can send group messages after the group owner or admins have muted all the group members using the [mute-all](./manage-group-mutelist#muting-all-chat-group-members) method. Chat provides a complete set of allow list management methods, including adding users to the allow list and removing them from it, as well as retrieving the members on the allow list.

This page shows how to manage a group allow list using the Chat RESTful APIs. Before calling the following methods, ensure that you understand the call frequency limit described in [Limitations](../limitations#call-limit-of-server-sides).

## Common parameters [#common-parameters]

The following table lists common request and response parameters of the Chat RESTful APIs:

### Request parameters [#request-parameters]

| Parameter  | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                          | Required |
| :--------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `host`     | String | The domain name assigned by the Chat service to access RESTful APIs. For how to get the domain name, see [Get the information of your project](/en/realtime-media/im/get-started/enable#get-the-information-of-the-agora-chat-project).                                                                                                                                                                                                              | Yes      |
| `app_id`   | String | The unique identifier automatically assigned to each project by Agora                                                                                                                                                                                                                                                                                                                                                                                | Yes      |
| `username` | String | The unique login account of the user. The user ID must be 64 characters or less and cannot be empty. The following character sets are supported:* 26 lowercase English letters (a-z)
* 10 numbers (0-9)
* "\_", "-", "."<CalloutContainer type="info">
  <CalloutDescription>
    Do not use any of the 26 uppercase English letters (A-Z). Ensure that each `username` under the same App ID is unique.
  </CalloutDescription>
</CalloutContainer> | Yes      |

### Response parameters [#response-parameters]

| Parameter         | Type   | Description                                                                                          |
| :---------------- | :----- | :--------------------------------------------------------------------------------------------------- |
| `action`          | String | The request method.                                                                                  |
| `organization`    | String | The unique identifier assigned to each company (organization) by the Chat service.                   |
| `application`     | String | A unique internal ID assigned to each app by the Chat service. You can safely ignore this parameter. |
| `applicationName` | String | The unique identifier assigned to each app by the Chat service.                                      |
| `uri`             | String | The request URI.                                                                                     |
| `path`            | String | The request path, which is part of the request URI. You can safely ignore this parameter.            |
| `entities `       | JSON   | The response entity.                                                                                 |
| `data`            | JSON   | The details of the response.                                                                         |
| `timestamp`       | Number | The Unix timestamp (ms) of the HTTP response.                                                        |
| `duration`        | Number | The duration (ms) from when the HTTP request is sent to the time the response is received.           |

## Authorization [#authorization]

Chat RESTful APIs require Bearer HTTP authentication. Every time an HTTP request is sent, the following `Authorization` field must be filled in the request header:

```html
Authorization: Bearer ${YourAppToken}
```

In order to improve the security of the project, Agora uses a token (dynamic key) to authenticate users before they log in to the chat system. Chat RESTful APIs only support authenticating users using app tokens. For details, see [Authentication using App Token](/en/realtime-media/im/build/secure-access-and-authentication/authentication).

## Retrieving the group allow list [#retrieving-the-group-allow-list]

This method retrieves the list of all the members on the group allow list.

### HTTP request [#http-request]

```bash
GET https://{host}/app-id/{app_id}/chatgroups/{group_id}/white/users
```

#### Path parameter [#path-parameter]

| Parameter  | Type   | Description   | Required |
| ---------- | ------ | ------------- | -------- |
| `group_id` | String | The group ID. | Yes      |

For other parameters and detailed descriptions, see [Common parameters](#param).

#### Request header [#request-header]

| Parameter       | Type   | Description                                                                                                                                                                              | Required |
| :-------------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `Content-Type`  | String | The parameter type. Set it as `application/json`.                                                                                                                                        | Yes      |
| `Authorization` | String | The authentication token of the user or admin, in the format of `Bearer ${token}`, where `Bearer` is a fixed character, followed by an English space, and then the obtained token value. | Yes      |

### HTTP response [#http-response]

#### Response body [#response-body]

If the returned HTTP status code is 200, the request succeeds, and the `data` field in the response body contains the user IDs on the group allow list. For other parameters and detailed descriptions, see [Common parameters](#param).

If the returned HTTP status code is not 200, the request fails. You can refer to [Status code](../http-status-codes) for possible causes.

### Example [#example]

#### Request example [#request-example]

```bash
curl -X GET -H 'Accept: application/json' -H 'Authorization: Bearer {Your app token}' 'http://XXXX/app-id/XXXX/chatgroups/{The group ID}/white/users'
```

#### Response example [#response-example]

```json
{
    "action": "get",
    "application": "5cf28979-XXXX-XXXX-b969-60141fb9c75d",
    "uri": "http://XXXX/app-id/XXXX/chatgroups/1208XXXX5169153/white/users",
    "entities": [],
    "data": [
        "username1",
        "username2",
        "username3",
        "username4",
        "username5"
    ],
    "timestamp": 1594724947117,
    "duration": 3,
    "organization": "XXXX",
    "applicationName": "XXXX",
    "count": 5
}
```

## Adding a member to the group allow list [#adding-a-member-to-the-group-allow-list]

This method adds the specified user to the group allow list. Members in the group allow list can still send group messages after the group owner or admin has muted all the group members using the [mute-all](./manage-group-mutelist#muting-all-chat-group-members) method.

### HTTP request [#http-request-1]

```html
POST https://{host}/app-id/{app_id}/chatgroups/{group_id}/white/users/{username}
```

#### Path parameter [#path-parameter-1]

| Parameter  | Type   | Description                                               | Required |
| ---------- | ------ | --------------------------------------------------------- | -------- |
| `group_id` | String | The group ID.                                             | Yes      |
| `username` | String | The user ID that you want to add to the group allow list. | Yes      |

For other parameters and detailed descriptions, see [Common parameters](#param).

#### Request header [#request-header-1]

| Parameter       | Type   | Description                                                                                                                                                                              | Required |
| :-------------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `Content-Type`  | String | The parameter type. Set it as `application/json`.                                                                                                                                        | Yes      |
| `Authorization` | String | The authentication token of the user or admin, in the format of `Bearer ${token}`, where `Bearer` is a fixed character, followed by an English space, and then the obtained token value. | Yes      |

### HTTP response [#http-response-1]

#### Response body [#response-body-1]

If the returned HTTP status code is 200, the request succeeds, and the `data` field in the response body contains the following fields:

| Parameter | Type    | Description                                                                                       |
| --------- | ------- | ------------------------------------------------------------------------------------------------- |
| `result`  | Boolean | Whether the group member is successfully added to the group allow list. `true`: Yes. `false`: No. |
| `reason`  | String  | The reason for failing to add the member to the allow list.                                       |
| `groupid` | String  | The group ID.                                                                                     |
| `action`  | String  | The operation of the method call.                                                                 |
| `user`    | String  | The user ID added to the allow list.                                                              |

For other parameters and detailed descriptions, see [Common parameters](#param).

If the returned HTTP status code is not 200, the request fails. You can refer to [Status code](../http-status-codes) for possible causes.

### Example [#example-1]

#### Request example [#request-example-1]

```bash
curl -X POST -H 'Accept: application/json' -H 'Authorization: Bearer {Your app token}' 'http://XXXX/app-id/XXXX/chatgroups/{The group ID}/white/users/{username}'
```

#### Response example [#response-example-1]

```json
{
    "action": "post",
    "application": "5cf28979-XXXX-XXXX-b969-60141fb9c75d",
    "uri": "http://XXXX/app-id/XXXX/chatgroups/120824965169153/white/users/username1",
    "entities": [],
    "data": {
        "result": true,
        "action": "add_user_whitelist",
        "user": "username1",
        "groupid": "1208XXXX5169153"
    },
    "timestamp": 1594724293063,
    "duration": 4,
    "organization": "XXXX",
    "applicationName": "XXXX"
}
```

## Adding multiple members to the group allow list [#adding-multiple-members-to-the-group-allow-list]

This method adds multiple members to the group allow list. You can add a maximum of 60 group members to the allow list per method call.

### HTTP request [#http-request-2]

```html
POST https://{host}/app-id/{app_id}/chatgroups/{group_id}/white/users
```

| Parameter  | Type   | Description   | Required |
| ---------- | ------ | ------------- | -------- |
| `group_id` | String | The group ID. | Yes      |

For other parameters and detailed descriptions, see [Common parameters](#param).

#### Request header [#request-header-2]

| Parameter       | Type   | Description                                                                                                                                                                              | Required |
| :-------------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `Content-Type`  | String | The parameter type. Set it as `application/json`.                                                                                                                                        | Yes      |
| `Authorization` | String | The authentication token of the user or admin, in the format of `Bearer ${token}`, where `Bearer` is a fixed character, followed by an English space, and then the obtained token value. | Yes      |

#### Request body [#request-body]

| Parameter   | Type  | Description                                                |
| ----------- | ----- | ---------------------------------------------------------- |
| `usernames` | Array | The user IDs that you want to add to the group allow list. |

### HTTP response [#http-response-2]

If the returned HTTP status code is 200, the request succeeds, and the `data` field in the response body contains the following fields:

| Parameter | Type    | Description                                                                                       |
| --------- | ------- | ------------------------------------------------------------------------------------------------- |
| `result`  | Boolean | Whether the group member is successfully added to the group allow list. `true`: Yes. `false`: No. |
| `reason`  | String  | The reason for failing to add the member to the allow list.                                       |
| `groupid` | String  | The group ID.                                                                                     |
| `action`  | String  | The operation of the method call.                                                                 |
| `user`    | String  | The user ID added to the allow list.                                                              |

For other parameters and detailed descriptions, see [Common parameters](#param).

If the returned HTTP status code is not 200, the request fails. You can refer to [Status code](../http-status-codes) for possible causes.

### Example [#example-2]

#### Request example [#request-example-2]

```bash
curl -X POST -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Authorization: Bearer {Your app token}' -d '{"usernames" : ["user1"]}' 'http://XXXX/app-id/XXXX/chatgroups/{The group ID}/white/users'
```

#### Response example [#response-example-2]

```json
{
    "action": "post",
    "application": "5cf28979-XXXX-XXXX-b969-60141fb9c75d",
    "uri": "http://XXXX/app-id/XXXX/chatgroups/1208XXXX5169153/white/users",
    "entities": [],
    "data": [
        {
            "result": true,
            "action": "add_user_whitelist",
            "user": "username1",
            "groupid": "1208XXXX5169153"
        },
        {
            "result": true,
            "action": "add_user_whitelist",
            "user": "username2",
            "groupid": "1208XXXX5169153"
        }
    ],
    "timestamp": 1594724634191,
    "duration": 2,
    "organization": "XXXX",
    "applicationName": "XXXX"
}
```

## Removing members from the group allow list [#removing-members-from-the-group-allow-list]

This method removes the specified member(s) from the group allow list. You can remove a maximum of 60 group members from the allow list per method call.

### HTTP request [#http-request-3]

```html
DELETE https://{host}/app-id/{app_id}/chatgroups/{group_id}/white/users/{username}
```

#### Path parameter [#path-parameter-2]

| Parameter  | Type   | Description                                                                                                                            | Required |
| ---------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `group_id` | String | The group ID.                                                                                                                          | Yes      |
| `username` | String | The user ID(s) that you want to remove from the allow list. For multiple user IDs, use the English comma "," to separate each user ID. | Yes      |

For other parameters and detailed descriptions, see [Common parameters](#param).

#### Request header [#request-header-3]

| Parameter       | Type   | Description                                                                                                                                                                              | Required |
| :-------------- | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `Content-Type`  | String | The parameter type. Set it as `application/json`.                                                                                                                                        | Yes      |
| `Authorization` | String | The authentication token of the user or admin, in the format of `Bearer ${token}`, where `Bearer` is a fixed character, followed by an English space, and then the obtained token value. | Yes      |

### HTTP response [#http-response-3]

If the returned HTTP status code is 200, the request succeeds, and the `data` field in the response body contains the following fields:

| Parameter | Type    | Description                                                                                           |
| --------- | ------- | ----------------------------------------------------------------------------------------------------- |
| `result`  | Boolean | Whether the group member is successfully removed from the group allow list. `true`: Yes. `false`: No. |
| `reason`  | String  | The reason for failing to remove the member from the allow list.                                      |
| `groupid` | String  | The group ID.                                                                                         |
| `action`  | String  | The operation of the method call.                                                                     |
| `user`    | String  | The user ID removed from the allow list.                                                              |

For other parameters and detailed descriptions, see [Common parameters](#param).

If the returned HTTP status code is not 200, the request fails. You can refer to [Status code](../http-status-codes) for possible causes.

### Example [#example-3]

#### Request example [#request-example-3]

```bash
curl -X DELETE -H 'Accept: application/json' -H 'Authorization: Bearer {Your app token}' 'http://XXXX/app-id/XXXX/chatgroups/1208XXXX5169153/white/users/{username}'
```

#### Response example [#response-example-3]

```json
{
    "action": "delete",
    "application": "5cf28979-XXXX-XXXX-b969-60141fb9c75d",
    "uri": "http://XXXX/app-id/XXXX/chatgroups/1208XXXX5169153/white/users/username1,username2",
    "entities": [],
    "data": [
        {
            "result": true,
            "action": "remove_user_whitelist",
            "user": "username1",
            "groupid": "1208XXXX5169153"
        },
        {
            "result": true,
            "action": "remove_user_whitelist",
            "user": "username2",
            "groupid": "1208XXXX5169153"
        }
    ],
    "timestamp": 1594725137704,
    "duration": 1,
    "organization": "XXXX",
    "applicationName": "XXXX"
}
```