---
title: "Ban the owner of an audit finding"
method: POST
path: "/stats/audits/findings/{findingId}/ban-owner"
tags: ["Stats"]
---

# Ban the owner of an audit finding

`POST /stats/audits/findings/{findingId}/ban-owner`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/audits/findings/{findingId}/ban-owner`
- Auth: `bearer` (a scheme the document does not define)

Admin-only. Runs the full user ban (ADR 0048) on the finding’s owner, without the email-domain block, then marks this finding and the owner’s other open findings in the report actioned. Refused while the owner has a suspected-CSAM finding and no evidence case.

## Path parameters

- `findingId` string, required

## Request body

- BanAuditOwnerDto
  - `reason` string, required: Why the owner is banned. Stored on the user and recorded in the activity feed and in the review note of the findings.

## Response `200`

- APIAuditBanOwnerResult
  - `ban` APIAdminBanResult, required
    - `userId` string, required: User id (UUID).
    - `bannedAt` string, required: Ban time (ISO 8601).
    - `tokensRevoked` number, required: API and MCP/OAuth tokens revoked.
    - `sitesSuspended` number, required: Sites suspended across the accounts the user owns.
    - `previewsDiscarded` number, required: Live previews discarded.
    - `subscriptionsCanceled` number, required: Stripe subscriptions cancelled immediately.
    - `domainBlocked` string, nullable, required: The domain a new `block` rule was added for, or null when none was added.
    - `failures` string[], required: Human-readable descriptions of takedown steps that failed.
  - `findings` APIAuditFinding[], required: Every finding in the report on the banned owner, read again: the one banned from and the other open ones are now actioned.
    - `id` string, required
    - `reportId` string, required
    - `subdomain` string, required
    - `siteId` string, nullable, required: Null when the site was deleted after the audit.
    - `siteStatus` string, nullable, required: The site status now, e.g. `live` or `suspended`.
    - `siteSuspendedReason` string, nullable, required
    - `accountId` string, nullable, required
    - `ownerUserId` string, nullable, required
    - `ownerEmail` string, nullable, required: The owner’s address at publish time.
    - `ownerBanned` boolean, required: The owner is banned now.
    - `ownerEvidenceCases` number, required: Evidence cases (ADR 0061) opened on the owner. A ban from the audit needs one when the owner has a suspected-CSAM finding.
    - `category` 'csam' | 'phishing' | 'malware' | 'illegal' | 'scam' | 'spam' | 'suspicious' | 'privacy', required
    - `confidence` 'high' | 'medium' | 'low', required
    - `summary` string, required
    - `evidence` string, nullable, required
    - `tier` 'A' | 'B' | 'C' | 'D', required: Null for findings with no tier.
    - `recommendedAction` 'ban_owner' | 'suspend_site' | 'email_owner' | 'dismiss', required: Null for open findings with no recommendation.
    - `recommendationReason` string, nullable, required: Why that tier and that action.
    - `status` 'open' | 'actioned' | 'dismissed', required
    - `reviewNote` string, nullable, required
    - `reviewedAt` string, nullable, required
    - `reviewedByName` string, nullable, required
    - `createdAt` string, required

## Other responses

- `400`: No owner on the finding, self-ban or an admin target
- `403`: Admin access required
- `404`: Finding or owner not found
- `409`: Already banned, or a CSAM finding with no evidence case

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)