---
title: "Lists detection feedback reports"
method: GET
path: "/1.1/feedback"
tags: ["Feedback"]
---

# Lists detection feedback reports

`GET /1.1/feedback`

## Request

- Base URL: `https://customer-api.datadome.co`
- URL: `https://customer-api.datadome.co/1.1/feedback`
- Auth: API key in header `x-api-key`

Lists the reports on your account, newest first, ordered by `createdAt` descending.

**Paging is by cursor.** Read `meta.nextCursor` and send it back as `cursor`. On the last page the key is absent rather than null, so test for its presence. There are no `page` or `offset` parameters.

All filters are optional and combine with AND. Unknown query parameters are ignored rather than rejected, so check the spelling of a filter that appears to have no effect. Reports older than six months are not returned, whatever `createdAfter` asks for.

There is no account parameter: results are always scoped to the API key you authenticate with.

## Query parameters

- `limit` integer
- `cursor` string
- `createdAfter` string, date-time
- `createdBefore` string, date-time
- `entityType` 'ip' | 'requestId' | 'sessionId' | 'userId'
- `entityId` string
- `timeWindowFrom` string, date-time
- `timeWindowTo` string, date-time
- `feedbackType` 'falsePositive' | 'falseNegative'
- `status` 'pending' | 'processing' | 'completed' | 'canceled'
- `severity` 'low' | 'medium' | 'high' | 'critical'
- `origin` 'manualReview' | 'chargebacks' | 'automatedRule' | 'dashboard' | 'datadome' | 'other'
- `trafficFilter` string

## Response `200`

One page of reports, newest first.

- FeedbackPage: One page of reports, newest first.
  - `meta` FeedbackPageMeta: Where you are in the result set.
    - `totalCount` integer: How many reports match the filters, across all pages.
    - `hasMore` boolean: Whether a further page exists.
    - `nextCursor` string: Pass this back as `cursor` to fetch the next page. **Absent, not null, on the last page** - so test for the key, not for a null value.
  - `data` Feedback[]: The reports on this page. An empty result is an empty array.
    - `feedbackId` string, uuid: Identifier of the report. Use it to retrieve or cancel the report.
    - `customerId` integer: The account the report belongs to, taken from the API key you submitted it with.
    - `status` 'pending' | 'processing' | 'completed' | 'canceled': Where the report is in our review. A new report is always `pending`. Only a `pending` report can be canceled.
    - `feedbackType` 'falsePositive' | 'falseNegative': What the detection got wrong. `falsePositive` reports legitimate traffic that was challenged or blocked. `falseNegative` reports unwanted traffic that was allowed through.
    - `severity` 'low' | 'medium' | 'high' | 'critical': The severity you submitted, or `medium` when you omitted it.
    - `origin` string, nullable: The origin you submitted, or `null`.
    - `originId` string, nullable: The identifier you submitted, or `null`.
    - `createdAt` string, date-time: When we received the report. ISO-8601 with millisecond precision.
    - `completedAt` string, date-time, nullable: When our review finished. `null` until the status is `completed`, and `null` for a canceled report.
    - `comment` string, nullable: What our analysts concluded. `null` until the review is complete. You cannot set this field.
    - `feedbackReason` string, nullable: The explanation you submitted, or `null`.
    - `expectedDecision` string, nullable: Reserved for a future use. Always `null`, and a request that sets it is rejected. Present only so that clients deserializing the full response do not meet an undeclared field.
    - `timeWindow` FeedbackTimeWindow: When the traffic you are reporting happened. The window is the closed interval `[start, end]`: both bounds are included, so `end` may equal `start` to report a single instant. The window may span at most 30 days, may not start more than 30 days in the past, and may not extend into the future beyond a 5 minute tolerance for clock skew. Note the deliberate asymmetry with search. A submitted window is closed, while `timeWindowFrom` and `timeWindowTo` on the search operation form the half-open interval `[timeWindowFrom, timeWindowTo)`. Search returns a report when its stored `start` is before `timeWindowTo` and its stored `end` is at or after `timeWindowFrom`, which is correct precisely because the stored window is closed.
      - `start` string, date-time, required: Start of the window, included. ISO-8601 with a timezone offset, to second or millisecond precision. Four or more fractional digits are rejected.
      - `end` string, date-time, required: End of the window, included. Must be at or after `start`; equal bounds denote a single instant.
    - `scope` FeedbackScope: Which traffic the report covers. Give `entities`, or `trafficFilter`, or both. A request that supplies neither is rejected. A `trafficFilter` that is empty or contains only whitespace counts as not supplied.
      - `entities` object, nullable: An explicit list of identifiers to report. Both members are required when `entities` is present, and `values` must be a JSON array, not an object. `null` in a response when the report was scoped by traffic filter alone.
        - `type` 'ip' | 'requestId' | 'sessionId' | 'userId', required: What kind of identifier `values` holds. Every entry in `values` must be of this kind.
        - `values` string[], required: The identifiers to report. At most 1000 entries, each at most 512 characters. When `type` is `ip`, every entry must be a valid IP address.
      - `trafficFilter` string, nullable: A DataDome query that selects the traffic to report, in the same syntax the dashboard search accepts, for example `countrycode:FR` or `NOT countrycode:(BE OR BG)`. Wildcards are accepted, as in the dashboard search. The query is validated when you submit it; an invalid one is rejected with `400` and the message `Your query is invalid. Please check your query.` `null` in a response when the report was scoped by entities alone.

## Other responses

- `400`: A query parameter was rejected. Note this shape differs from the body validation error returned by the submit operation.
- `401`: No API key was supplied, or the key is unknown, disabled, or belongs to a blocked account. This response carries no rate-limit headers.
- `403`: Your plan does not include the Feedback API. It requires Bot Protect on an Enterprise, Enterprise+ or Premium subscription. This response does carry rate-limit headers, and it does consume one request from your budget.
- `424`: Our storage layer could not be reached. The report was not affected. Retry in a few minutes.
- `429`: You have used your 60 requests for the current minute. The budget is shared by all four Feedback operations and is counted per API key, so a second key on the same account has its own budget.

---

[API](https://skmtc.dev/datadome/apis/management-api.md) - [All operations](https://skmtc.dev/datadome/apis/management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/management-api/revisions/80062169b99e?raw)