---
title: "POST /api/admin/reviews/{id}/unpublish"
method: POST
path: "/api/admin/reviews/{id}/unpublish"
tags: ["Admin: Reviews"]
---

# POST /api/admin/reviews/{id}/unpublish

`POST /api/admin/reviews/{id}/unpublish`

## Request

- The document declares no server URL.
- Auth: API key in cookie `session`

Take a published review back to draft.

## Path parameters

- `id` integer, required

## Response `200`

The request has succeeded.

- Review: A student review/testimonial (legacy: `Review`).
  - `id` integer, required
  - `user` PublicUser, required: The part of a user that is safe to show anonymous visitors: the display name only, never the email or the admin flag. Embedded in public review and blog responses in place of `User`.
    - `id` integer, required
    - `firstName` string, nullable, required
    - `lastName` string, nullable, required
    - `name` string, nullable, required
  - `course` Course, required: A course (legacy: `Language`). Superset read model: the public catalog embeds it, admin course screens read the full shape.
    - `id` integer, required
    - `slug` string, required
    - `name` string, nullable, required
    - `learnAs` 'first_language' | 'second_language', required: How a course is meant to be learned.
    - `readiness` 'completed' | 'in_development' | 'draft', required: Publication/readiness state of a course.
    - `categoryId` integer, nullable, required
    - `currentVersionId` integer, nullable, required
    - `currentVersion` CourseVersion, required: A build/version of a course's exercises (legacy `LanguageVersion`).
      - `id` integer, required
      - `name` string, nullable, required: The name the course's spec gives this build (e.g. "JavaScript"). Legacy's lesson page opens its meta description with it, in brackets.
      - `result` string, nullable, required
      - `state` string, nullable, required
      - `createdAt` string, date-time, required
    - `createdAt` string, date-time, required
    - `enrollmentsCount` integer, required
    - `lessonsCount` integer, required
    - `ratingCount` integer, required
    - `ratingValue` number, double, required
    - `repositoryUrl` string, nullable, required
    - `hexletProgramLandingPage` string, nullable, required
    - `coverListVariant` string, nullable, required
    - `coverThumbVariant` string, nullable, required
  - `userId` integer, required
  - `courseId` integer, required
  - `body` string, nullable, required
  - `firstName` string, nullable, required
  - `lastName` string, nullable, required
  - `fullName` string, nullable, required
  - `state` 'draft' | 'published' | 'archived', required: Review publication state.
  - `locale` 'ru' | 'en', required: Reviews only target ru/en today (legacy `ReviewLocale`).
  - `pinned` boolean, nullable, required: Stored for the admin edit form to round-trip; it does not affect the public list, which legacy ordered newest first only.
  - `createdAt` string, date-time, required

## Other responses

- `default`: Default error response shared by every operation. `@error` emits an OpenAPI `default` response, keeping central transport failures typed without enumerating every status on every operation.

## Changes

- **2026-10-18** `9380d4c85a04`: 3 info
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
  - added the optional property `errors` to the response with the `default` status
- **2026-10-17** `023e7c2cd140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/changes/api/admin/reviews/:id/unpublish/post.md)

---

[API](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api.md) · [All operations](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/revisions/51c7f596b47c?raw)