add blacklist/whitelist settings to self-service API, RT#20896