---
title: "Review Website Audit evidence"
method: POST
path: "/v1/website-audit/scans/{scanId}/review"
tags: ["Website Audit"]
---

# Review Website Audit evidence

`POST /v1/website-audit/scans/{scanId}/review`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/website-audit/scans/{scanId}/review`
- Auth: HTTP bearer

Reviews an unidentified observation through its evidenceId. Supports dismiss, mark_as_ours and report_vendor under the Dashboard rules. Requires projects.read and website-audit.write and an organization admin or owner. New public writes are gated by rollout-agent-access-writes, default false.

## Path parameters

- `scanId` string, required

## Request body

- union
  - object
    - `action` 'dismiss', required
    - `evidenceId` string, required
  - object
    - `action` 'mark_as_ours', required
    - `evidenceId` string, required
  - object
    - `action` 'report_vendor', required
    - `evidenceId` string, required

## Response `200`

Success

- object
  - `success` unknown, required
  - `data` WebsiteScanReviewResult, required
    - `action` 'dismiss' | 'mark_as_ours' | 'report_vendor', required
    - `domain` string, nullable, required
    - `evidenceId` string, required
    - `reviewItemId` string, nullable, required
    - `snapshot` object, required
      - `collection` 'website-scan-results', required
      - `organizationId` string, required
      - `projectionVersion` 1, required
      - `results` object, nullable, required
        - `changes` object, required
          - `availability` 'available' | 'no_comparable_scan', required
          - `newVendors` object[], required
            - `consentCategory` 'necessary' | 'measurement' | 'marketing' | 'functionality' | 'experience', nullable, required
            - `name` string, required
            - `vendorId` string, required
          - `noLongerDetectedVendors` object[], required
            - `consentCategory` 'necessary' | 'measurement' | 'marketing' | 'functionality' | 'experience', nullable, required
            - `name` string, required
            - `vendorId` string, required
        - `conditions` object[], required
          - `consentScenario` 'pre_consent' | 'pre_consent_gpc' | 'accept_all' | 'reject_all' | 'accept_measurement_only' | 'accept_marketing_only', required
          - `key` string, required
          - `regionProfile` 'uk_gdpr' | 'eu_eea_gdpr' | 'us_ca_cpra' | 'us_tx_baseline' | 'custom', required
          - `runId` string, required
        - `cookies` object[], required
          - `conditions` object[], required
            - `consentScenario` 'pre_consent' | 'pre_consent_gpc' | 'accept_all' | 'reject_all' | 'accept_measurement_only' | 'accept_marketing_only', required
            - `key` string, required
            - `regionProfile` 'uk_gdpr' | 'eu_eea_gdpr' | 'us_ca_cpra' | 'us_tx_baseline' | 'custom', required
            - `runId` string, required
          - `evidence` object[], required
            - `evidenceId` string, nullable, required
            - `key` string, required
            - `kind` 'script' | 'cookie' | 'storage' | 'network' | 'global_object' | 'package' | 'iframe' | 'header', required
            - `observationId` string, required
            - `observedAt` string, required
            - `pagePath` string, nullable, required
            - `runId` string, required
            - `url` string, nullable, required
            - `value` string, nullable, required
          - `evidenceIds` string[], required
          - `lastSeenAt` string, required
          - `observationCount` integer, required
          - `pagePaths` string[], required
          - `attributes` object, required
            - `expiresAt` union, required
              - …
            - `httpOnly` union, required
              - …
            - `lifetime` union, required
              - …
            - `sameSite` union, required
              - …
            - `secure` union, required
              - …
            - `session` union, required
              - …
          - `domain` string, nullable, required
          - `id` string, required
          - `name` string, required
          - `party` 'first_party' | 'third_party' | 'unknown', required
          - `path` string, nullable, required
          - `vendors` object[], required
            - `name` string, required
            - `projectVendorId` string, nullable, required
            - `reviewState` 'accepted' | 'suggested' | 'rejected' | 'needs_review', required
            - `vendorId` string, required
        - `coverage` object, required
          - `absenceClaimEligible` boolean, required
          - `attemptedPageCount` integer, required
          - `completedConditionCount` integer, required
          - `completedPageCount` integer, required
          - `conditions` object[], required
            - `attemptedPageCount` integer, required
            - `completedPageCount` integer, required
            - `failedPageCount` integer, required
            - `key` string, required
            - `status` 'pending' | 'completed' | 'failed', required
          - `failedPageCount` integer, required
          - `pages` object[]
            - `status` 'completed' | 'partial' | 'failed', required
            - `url` string, required
          - `totalConditionCount` integer, required
        - `dataQuality` object, required
          - `changes` 'frozen_at_completion' | 'no_comparable_scan', required
          - `cookieAttributes` 'point_in_time_snapshot' | 'legacy_unavailable', required
        - `summary` object, required
          - `cookieCount` integer, required
          - `firstPartyCookieCount` integer, required
          - `observationCount` integer, required
          - `pageCount` integer, required
          - `thirdPartyCookieCount` integer, required
          - `unidentifiedCount` integer, required
          - `vendorCount` integer, required
        - `unidentified` object[], required
          - `conditions` object[], required
            - `consentScenario` 'pre_consent' | 'pre_consent_gpc' | 'accept_all' | 'reject_all' | 'accept_measurement_only' | 'accept_marketing_only', required
            - `key` string, required
            - `regionProfile` 'uk_gdpr' | 'eu_eea_gdpr' | 'us_ca_cpra' | 'us_tx_baseline' | 'custom', required
            - `runId` string, required
          - `evidence` object[], required
            - `evidenceId` string, nullable, required
            - `key` string, required
            - `kind` 'script' | 'cookie' | 'storage' | 'network' | 'global_object' | 'package' | 'iframe' | 'header', required
            - `observationId` string, required
            - `observedAt` string, required
            - `pagePath` string, nullable, required
            - `runId` string, required
            - `url` string, nullable, required
            - `value` string, nullable, required
          - `evidenceIds` string[], required
          - `lastSeenAt` string, required
          - `observationCount` integer, required
          - `pagePaths` string[], required
          - `domain` string, nullable, required
          - `evidenceKinds` string[], required
          - `id` string, required
          - `label` string, required
          - `party` 'first_party' | 'third_party' | 'unknown', required
        - `vendors` object[], required
          - `conditions` object[], required
            - `consentScenario` 'pre_consent' | 'pre_consent_gpc' | 'accept_all' | 'reject_all' | 'accept_measurement_only' | 'accept_marketing_only', required
            - `key` string, required
            - `regionProfile` 'uk_gdpr' | 'eu_eea_gdpr' | 'us_ca_cpra' | 'us_tx_baseline' | 'custom', required
            - `runId` string, required
          - `evidence` object[], required
            - `evidenceId` string, nullable, required
            - `key` string, required
            - `kind` 'script' | 'cookie' | 'storage' | 'network' | 'global_object' | 'package' | 'iframe' | 'header', required
            - `observationId` string, required
            - `observedAt` string, required
            - `pagePath` string, nullable, required
            - `runId` string, required
            - `url` string, nullable, required
            - `value` string, nullable, required
          - `evidenceIds` string[], required
          - `lastSeenAt` string, required
          - `observationCount` integer, required
          - `pagePaths` string[], required
          - `categorySource` 'global_default' | 'identifier_default' | 'project_override' | 'scan_inferred' | 'ai_suggested', nullable, required
          - `change` 'new' | 'previously_detected', nullable, required
          - `confidence` 'high' | 'medium' | 'low', required
          - `consentCategory` 'necessary' | 'measurement' | 'marketing' | 'functionality' | 'experience', nullable, required
          - `evidenceKinds` string[], required
          - `homepageUrl` string, nullable, required
          - `matchIds` string[], required
          - `name` string, required
          - `privacyPolicyUrl` string, nullable, required
          - `projectVendorId` string, nullable, required
          - `reviewState` 'accepted' | 'suggested' | 'rejected' | 'needs_review', required
          - `slug` string, required
          - `state` 'active' | 'not_seen_recently' | 'ignored' | 'approved' | 'blocked', nullable, required
          - `vendorId` string, required
      - `scanId` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/website-audit/scans/:scanId/review/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)