---
title: "Update report visibility"
method: PATCH
path: "/v1/reports/{id}"
tags: ["Reports"]
---

# Update report visibility

`PATCH /v1/reports/{id}`

## Request

- Base URL: `https://api.squirrelscan.com`
- URL: `https://api.squirrelscan.com/v1/reports/{id}`
- Auth: HTTP bearer

Change a report's visibility. Owner only: a non-owner (or unauthenticated request) gets 404, never revealing the report's existence. Visibility changes carry no separate credit charge; publishing is included in the audit's base charge.

## Path parameters

- `id` string, required

## Request body

- object
  - `visibility` 'public' | 'unlisted' | 'private', required

## Response `200`

Updated visibility.

- object
  - `id` string, required
  - `visibility` 'public' | 'unlisted' | 'private', required
  - `url` string, uri, required

## Other responses

- `400`: Request body or query failed validation. `error.issues` lists up to 10 failed fields (`{ path, message }`); when more failed, `error.truncated: true` and `error.totalIssues` indicate the full count.
- `401`: Missing or invalid credentials (including the shared auth middleware: no/invalid bearer token). Typed envelope with code `UNAUTHORIZED`. Branch on the `401` status, not the message.
- `402`: The organization does not have enough credits for this operation. Typed envelope with code `INSUFFICIENT_CREDITS`; `error.required` and `error.balance` carry the credit detail. Branch on the `402` status.
- `404`: Report not found / not owned by the caller, OR — only when flipping to `public` — the report's stored content is missing from R2. Both use the typed envelope with code `NOT_FOUND`; branch on the 404 status.
- `429`: Too many requests. Retry after the window resets. (Rate limiting is planned — issue #69 — these headers document the intended contract.)

---

[API](https://skmtc.dev/squirrelscan/apis/squirrelscan-public-api.md) · [All operations](https://skmtc.dev/squirrelscan/apis/squirrelscan-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/squirrelscan/apis/squirrelscan-public-api/revisions/82c8183fe8bc?raw)