but doesn't this mean that the blacklist is checked on each api request?