Filters

Filters let you act on content that matches words, domains, emails, or regex patterns. The action (flag, remove, mask, and the others on a policy) is set when you attach the filter.

To use filters, you first create a filter, then attach it to a moderation policy.

Filter Types

Word Matching

Word blocklists match exact words (case-insensitive). Adjacent punctuation is ignored, but partial word matches are not.

For a blocklist containing dogs, house:

• "Dogs, are great" — matches (case-insensitive, ignores comma)
• "I live in a lighthouse" — does not match (no partial match on house)

With leet speak detection enabled: d0g matches dog, w0m@n matches woman. With plural detection enabled: houses matches house, dog matches dogs. With confusable folding enabled, lookalike letters count as the plain letter. With substring matching enabled, the word can match inside a longer token. Both are off unless you set them on the filter.

Domain Matching

Domain filters match the suffix of URLs. gmail.com matches https://gmail.com, http://support.gmail.com, etc. A more specific filter like messenger.facebook.com only matches that subdomain.

When a domain_allowlist is attached to the policy, those hosts also win for AI link detection. Allow-listed URLs are not treated as unknown or forbidden links. Other AI labels on the same message (for example scam or harassment) still apply. Attachment URLs on the allowlist are skipped the same way.

Regex Matching

Regex filters support standard regular expression syntax. Tips:

• Use (?i) for case-insensitive matching
• Use \b for whole-word boundaries
• Escape special characters with \
• Max 100 patterns per filter, max 60 characters per pattern

Create a Blocklist

Create a custom blocklist with a name, type, and list of entries.

// Create a word blocklist
await client.CreateBlockListAsync(new CreateBlockListRequest
{
    Name = "profanity_custom",
    Words = new List<string> { "badword1", "badword2", "offensive" },
    Type = "word",
});

// Create a domain blocklist
await client.CreateBlockListAsync(new CreateBlockListRequest
{
    Name = "blocked_domains",
    Words = new List<string> { "spam-site.com", "phishing.net" },
    Type = "domain",
});

// Create a regex filter
await client.CreateBlockListAsync(new CreateBlockListRequest
{
    Name = "phone_numbers",
    Words = new List<string> { @"\b\d{3}[-.]?\d{3}[-.]?\d{4}\b" },
    Type = "regex",
});

// Create a domain allowlist (only these domains are permitted)
await client.CreateBlockListAsync(new CreateBlockListRequest
{
    Name = "trusted_domains",
    Words = new List<string> { "myapp.com", "getstream.io" },
    Type = "domain_allowlist",
});

// Create an email allowlist
await client.CreateBlockListAsync(new CreateBlockListRequest
{
    Name = "approved_emails",
    Words = new List<string> { "support@myapp.com", "info@myapp.com" },
    Type = "email_allowlist",
});

Request Parameters

Update a Blocklist

Replace the word list or settings of an existing blocklist.

await client.UpdateBlockListAsync("profanity_custom", new UpdateBlockListRequest
{
    Words = new List<string> { "badword1", "badword2", "offensive", "newword" },
    IsLeetCheckEnabled = true,
    IsPluralCheckEnabled = true,
});

List Blocklists

var response = await client.ListBlockListsAsync();

Get a Blocklist

var response = await client.GetBlockListAsync("profanity_custom");

Delete a Blocklist

await client.DeleteBlockListAsync("profanity_custom");

Attach a Blocklist to a Policy

Once created, attach your blocklist to a moderation policy to activate it. Each rule specifies the blocklist name and the action to take when matched.

await client.UpsertConfigAsync(new UpsertConfigRequest
{
    Key = "chat:messaging",
    BlockListConfig = new BlockListConfig
    {
        Rules = new List<BlockListRule>
        {
            new() { Name = "profanity_custom", Action = "remove" },
            new() { Name = "blocked_domains", Action = "flag" },
            new() { Name = "phone_numbers", Action = "flag" },
        },
    },
});

Text normalization

Before filters run, HTML entities are turned back into characters (decimal, hex, and named, with or without a trailing semicolon) and invisible characters such as zero-width spaces are removed. A word list containing spam therefore matches visit spam now, and a regex (?i)https?:// matches an entity-encoded URL.

The stored message is not rewritten. See Text Normalization for the full list of entity forms, invisible code points, and what is not decoded (percent-encoding, fullwidth letters, homoglyphs).

Limits

Some of these limits can be raised on request. Contact support.