---
title: "Suspend or unsuspend one project's public serving with captured evidence (ADR 0080)"
method: POST
path: "/internal/operator/projects/{id}/enforcement-actions"
---

# Suspend or unsuspend one project's public serving with captured evidence (ADR 0080)

`POST /internal/operator/projects/{id}/enforcement-actions`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/internal/operator/projects/{id}/enforcement-actions`
- Auth: none declared

## Path parameters

- `id` string, required

## Request body

- InternalProjectEnforcementActionRequest
  - `action` 'suspend' | 'unsuspend', required
  - `reasonCategory` 'phishing' | 'malware' | 'shared_domain_abuse' | 'spam' | 'illegal_content' | 'legal_order' | 'other_policy_violation' | 'remediated' | 'false_positive' | 'appeal_granted' | 'legal_order_lifted', required
  - `reasonText` string, required
  - `clientRequestId` string, required
  - `evidenceUrls` string[]: Required for suspend: https URLs on hosts this project serves.
  - `requestIds` string[]
  - `reportReference` string, nullable

## Response `200`

The appended, replayed or unchanged action and, after a suspension, whether a Gateway served it

- InternalProjectEnforcementActionResponse
  - `changed` boolean, required
  - `replayed` boolean, required
  - `action` ProjectEnforcementAction, required
    - `id` string, required
    - `sequence` integer, required
    - `action` 'suspend' | 'unsuspend', required
    - `reasonCategory` 'phishing' | 'malware' | 'shared_domain_abuse' | 'spam' | 'illegal_content' | 'legal_order' | 'other_policy_violation' | 'remediated' | 'false_positive' | 'appeal_granted' | 'legal_order_lifted', required
    - `reasonText` string, required
    - `operatorUserId` string, required
    - `operatorEmail` string, nullable
    - `clientRequestId` string, required
    - `requestId` string, nullable
    - `evidence` object, required: project-enforcement-evidence.v1 captured at action time; at most 64 KiB.
    - `createdAt` string, date-time, required
  - `state` ProjectEnforcementState, required
    - `suspended` boolean, required
    - `reasonCategory` string, nullable, required
    - `since` string, date-time, nullable, required
    - `sequence` integer, required
  - `notification` object, nullable, required
    - `inApp` 'created' | 'failed'
    - `email` 'sent' | 'not_configured' | 'no_recipient' | 'failed'
  - `verification` object, required
    - `status` 'verified' | 'not_verified' | 'not_attempted', required

## Other responses

- `403`: Owner operator lock required, or the project serves a Eurobase platform host
- `404`: Project not found
- `409`: enforcement-client-request-reused: clientRequestId was already used for a different action; enforcement-state-changed: the project state changed while the action was decided (retry with the same clientRequestId)
- `422`: Invalid action, reason, evidence URL or request id
- `429`: Operator enforcement rate limit reached

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)