The list is write-only
From the Suppression API reference. Requests use the base URL https://app.warmerly.com/api/v1 and an API key, see Authentication.
POST /suppression is the only customer-callable endpoint on this resource. Adding an address works with your API key and in the dashboard at Settings > Do not contact. Listing, exporting and removing are staff-only and return 404 not_found for a customer key, including an Agency one.
That split is deliberate. The list aggregates bounce evidence across every tenant, so enumerating or exporting it would expose which addresses other customers have been mailing. Adding stays open because it has to: someone who says "stop emailing me" on a call must be suppressible immediately, not after a support ticket.
If you need an address taken off the list, contact support since removal means campaigns may mail that person again, so it stays with operators and stays audit-logged.
404 here means "not available to you", not "no suppression list exists". It is deliberately indistinguishable from a missing route.