---
title: "Post Revision"
method: POST
path: "/v3/verdicts/{verdict_id}/revisions"
tags: ["verdicts"]
---

# Post Revision

`POST /v3/verdicts/{verdict_id}/revisions`

## Request

- Base URL: `https://api.etymolt.com`
- URL: `https://api.etymolt.com/v3/verdicts/{verdict_id}/revisions`
- Auth: none declared

Append a revision to a verdict. Requires auth + ownership.

Ownership check (R13 B21 fix)
-----------------------------

The previous gate was ``tier != "anon"`` — any signed-up user could
revise ANY verdict, including verdicts owned by other accounts. The
outbound webhook then fired with the attacker's revised_to into the
operator's calibration trainer. This was a public calibration-poisoning
primitive available to a $0 disposable-email signup.

The fix: load the verdict, compare its ``api_key_hash`` to the calling
key's ``hash``, and 403 on mismatch. Non-existent verdicts return 404
(same as before).

## Path parameters

- `verdict_id` string, required

## Request body

- RevisionReq
  - `revised_to` string, required
  - `revision_reason` string, nullable
  - `source` string, nullable
  - `evidence` object, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names.md) · [All operations](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/llms.txt) · [OpenAPI document](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/revisions/7228ffa1efa7?raw)