Whitelist field is a list, not string