Approve a Takedown

When your account is configured to require takedown approval, incidents pause in the approval_required status until someone on your side gives the go-ahead. This endpoint lets you approve the takedown programmatically by referencing the incident's id — the equivalent of pressing Approve on the incident page in the dashboard. After the user approves the takedown, the incident's status changes from approval_required to takedown_ready, indicating that it is ready to proceed.

Endpoint

POST /v1/incident/{id}/approve-takedown

Parameters

Parameter	Type	Required	Description
author	string	Yes	Who approved the takedown — typically the name or email address of the person at your organization who made the decision. Recorded on the incident history and in the audit trail. Limited to 256 characters.

Warning

The author field is required. Takedown approvals must be attributable to a person for audit purposes — requests without a valid non-empty author string are rejected with a 400 response.

Request Example

cURLPythonNode.js

curl -X POST 'https://capi.phishfort.com/v1/incident/{id}/approve-takedown' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"author": "jane.doe@yourcompany.com"}'

import requests

incident_id = "abc123efd"
response = requests.post(
    f"https://capi.phishfort.com/v1/incident/{incident_id}/approve-takedown",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
    json={"author": "jane.doe@yourcompany.com"},
)
print(response.json())

const incidentId = "abc123efd";
const response = await fetch(
  `https://capi.phishfort.com/v1/incident/${incidentId}/approve-takedown`,
  {
    method: "POST",
    headers: {
      accept: "application/json",
      "x-api-key": "YOUR_API_KEY",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      author: "jane.doe@yourcompany.com",
    }),
  }
);
const data = await response.json();
console.log(data);

Where {id} is the ID of the incident whose takedown you wish to approve. Both the incident IDs returned by List Incidents and the inc_… IDs returned when reporting an incident are accepted.

Response Example

{
    "message": "You approved the takedown request on incidentId: abc123efd",
    "id": "abc123efd"
}

Error Responses

Status	Meaning
400	The author field is missing, empty, not a string, or longer than 256 characters.
403	Your account has insufficient or expired takedown credits. Contact support to renew.
404	No incident with the provided ID was found on your account.
409	Either the incident is not currently awaiting takedown approval (already approved, or approval was never requested), or the id was reported within the last few minutes and is still being linked to its full record — check for a Retry-After header (typically 30 seconds) to tell the two apart, and retry in that case. See Using the Returned ID Right Away.
503	Takedown approval is temporarily unavailable. Retry later.

Note

Approving a takedown may consume a takedown credit, depending on your plan. See Credit Usage to check your remaining balance.