---
title: "Review an audit finding"
method: PATCH
path: "/stats/audits/findings/{findingId}"
tags: ["Stats"]
---

# Review an audit finding

`PATCH /stats/audits/findings/{findingId}`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/audits/findings/{findingId}`
- Auth: `bearer` (a scheme the document does not define)

Admin-only. Marks the finding actioned or dismissed, or opens it again. Changes nothing about the site or the user.

## Path parameters

- `findingId` string, required

## Request body

- ReviewAuditFindingDto
  - `status` 'open' | 'actioned' | 'dismissed', required
  - `note` string: What was done, or why it is not a problem. Empty clears it.

## Response `200`

- APIAuditFinding
  - `id` string, required
  - `reportId` string, required
  - `subdomain` string, required
  - `siteId` string, nullable, required: Null when the site was deleted after the audit.
  - `siteStatus` string, nullable, required: The site status now, e.g. `live` or `suspended`.
  - `siteSuspendedReason` string, nullable, required
  - `accountId` string, nullable, required
  - `ownerUserId` string, nullable, required
  - `ownerEmail` string, nullable, required: The owner’s address at publish time.
  - `ownerBanned` boolean, required: The owner is banned now.
  - `ownerEvidenceCases` number, required: Evidence cases (ADR 0061) opened on the owner. A ban from the audit needs one when the owner has a suspected-CSAM finding.
  - `category` 'csam' | 'phishing' | 'malware' | 'illegal' | 'scam' | 'spam' | 'suspicious' | 'privacy', required
  - `confidence` 'high' | 'medium' | 'low', required
  - `summary` string, required
  - `evidence` string, nullable, required
  - `tier` 'A' | 'B' | 'C' | 'D', required: Null for findings with no tier.
  - `recommendedAction` 'ban_owner' | 'suspend_site' | 'email_owner' | 'dismiss', required: Null for open findings with no recommendation.
  - `recommendationReason` string, nullable, required: Why that tier and that action.
  - `status` 'open' | 'actioned' | 'dismissed', required
  - `reviewNote` string, nullable, required
  - `reviewedAt` string, nullable, required
  - `reviewedByName` string, nullable, required
  - `createdAt` string, required

## Other responses

- `403`: Admin access required
- `404`: Finding not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)