---
title: "Submit an abuse notice (DSA Article 16)"
method: POST
path: "/api/reports"
tags: ["Notices"]
---

# Submit an abuse notice (DSA Article 16)

`POST /api/reports`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/reports`
- Auth: none required

**Unauthenticated by requirement.** Article 16 of Regulation (EU) 2022/2065 obliges us to let
"any individual or entity" notify us of content they consider illegal. A sign-in wall would
exclude exactly the people most likely to find a phishing page — the recipients of the message
that carried it.

`reporterName` and `reporterEmail` are optional, and that is required rather than lenient:
Article 16(2) exempts notices concerning offences under Directive 2011/93/EU (child sexual
abuse material) from identifying the submitter, so demanding an identity on every notice would
make us non-compliant for the most urgent category. Where an email is given, receipt is
acknowledged under Article 16(4).

Rate-limited per network address. The reporter's address is stored only as a salted hash.

## Request body

- SubmitReportRequest
  - `reportedUrl` string, required
  - `category` 'csam' | 'phishing_or_malware' | 'illegal_content' | 'intellectual_property' | 'impersonation' | 'privacy' | 'other', required
  - `explanation` string, required: Article 16(2)(a): a sufficiently substantiated explanation of why the content is alleged to be illegal.
  - `reporterName` string
  - `reporterEmail` string, email: Optional. Article 16(2) exempts CSAM notices from identifying the submitter.
  - `goodFaith` boolean: Article 16(2)(d). Recorded as given, including when withheld — a provider that drops notices lacking it is refusing notices it must accept.

## Response `201`

Notice recorded; returns a quotable reference

- object
  - `reference` string, required
  - `message` string

## Other responses

- `400`: Request did not match the Zod validation schema
- `429`: Velocity limit reached; response has Retry-After

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)