---
title: "Publish or hide a review"
method: POST
path: "/api/v1/reviews/{id}/moderate"
tags: ["reviews"]
---

# Publish or hide a review

`POST /api/v1/reviews/{id}/moderate`

## Request

- Base URL: `https://app.qrtap.kg`
- URL: `https://app.qrtap.kg/api/v1/reviews/{id}/moderate`
- Auth: HTTP bearer

The only way a guest review becomes visible on the public page. Publishing takes effect immediately. A review id from another organization answers 404.

## Path parameters

- `id` string, uuid, required

## Request body

- ModerateReviewRequest
  - `action` 'publish' | 'hide', required: `publish` shows the review on the public page; `hide` removes it.

## Response `200`

The review in its new state.

- Review
  - `id` string, uuid, required
  - `author_name` string, required: What the guest typed. No IP, user-agent or any other identifier is ever stored.
  - `body` string, required
  - `status` 'pending' | 'published' | 'hidden', required
  - `created_at` string, date-time, required
  - `moderated_at` string, date-time, nullable

## Other responses

- `400`: `action` missing or not publish | hide, or the id is not a UUID (`invalid_id`).
- `401`: Missing, invalid or revoked API key.
- `404`: No such object in your organization.
- `429`: Limit exceeded — the request had no effect. `error` is `rate_limited` with `scope: "minute"` (a burst brake: wait `retry_after` seconds and continue) or `quota_exceeded` with `scope: "day"` (the workspace's daily quota, counted in UTC; it returns at `reset_at`, the next UTC midnight, and only a higher plan raises it before then).

---

[API](https://skmtc.dev/qrtap/apis/qrtap-rest-api.md) · [All operations](https://skmtc.dev/qrtap/apis/qrtap-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrtap/apis/qrtap-rest-api/revisions/8af17ac525bd?raw)