# Organization API: Org Staff Abuse

> Every Organization API operation tagged Org Staff Abuse.

Source: https://www.coritan.com/docs/api/reference/organizations/org-staff-abuse/

Base URL: `https://api.coritan.com/api/v1`. Paths below are complete.

To try these requests in the browser, open the [interactive Organization API reference](https://api.coritan.com/docs/org).

## Operations

| Method | Path | Summary |
| --- | --- | --- |
| GET | [`/api/v1/orgs/{org_slug}/staff/abuse/patterns`](#op-get-api-v1-orgs-org-slug-staff-abuse-patterns) | List the values that many of your new accounts share within an hour |
| POST | [`/api/v1/orgs/{org_slug}/staff/abuse/patterns/{pattern_id}/block`](#op-post-api-v1-orgs-org-slug-staff-abuse-patterns-pattern-id-block) | Block a pattern's value for your brand, and mark the pattern blocked |
| POST | [`/api/v1/orgs/{org_slug}/staff/abuse/patterns/{pattern_id}/dismiss`](#op-post-api-v1-orgs-org-slug-staff-abuse-patterns-pattern-id-dismiss) | Dismiss a pattern for 1 to 90 days |
| GET | [`/api/v1/orgs/{org_slug}/staff/abuse/rules`](#op-get-api-v1-orgs-org-slug-staff-abuse-rules) | List the email domains, networks and server names your brand blocks or allows |
| POST | [`/api/v1/orgs/{org_slug}/staff/abuse/rules`](#op-post-api-v1-orgs-org-slug-staff-abuse-rules) | Block or allow an email domain, a network or a server name for your brand |
| DELETE | [`/api/v1/orgs/{org_slug}/staff/abuse/rules/{rule_id}`](#op-delete-api-v1-orgs-org-slug-staff-abuse-rules-rule-id) | Delete one of your brand's rules, so the value it matched is let in again |

### List the values that many of your new accounts share within an hour {#op-get-api-v1-orgs-org-slug-staff-abuse-patterns}

`GET /api/v1/orgs/{org_slug}/staff/abuse/patterns`

List the values that many of your new accounts share within an hour.

A pattern opens when enough distinct accounts made in the window share an
email domain, a sign-up network (an IPv4 /24 or IPv6 /48), a free-order
network or a server name. Each row carries up to five of its accounts, the
rule that blocks it if there is one, and who acted on it. ``counts`` has
the number of patterns in every status, whatever ``status`` asks for.
Needs Tier 3 support or above; lists only your brand's patterns.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `org_slug` | path | string | yes |  |
| `status` | query | string | no | Which patterns to list: open, blocked, dismissed, resolved or all. Any other word answers 422. Default: `open`. |
| `kind` | query | string or null | no | Only patterns of this kind: email_domain, signup_network, order_network or server_name. |
| `limit` | query | integer | no | Patterns per page, 1 to 200. Default: `50`. |
| `offset` | query | integer | no | How many patterns to skip, for the next page. Default: `0`. |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Block a pattern's value for your brand, and mark the pattern blocked {#op-post-api-v1-orgs-org-slug-staff-abuse-patterns-pattern-id-block}

`POST /api/v1/orgs/{org_slug}/staff/abuse/patterns/{pattern_id}/block`

Block a pattern's value for your brand, and mark the pattern blocked.

An email domain pattern blocks the domain, so it can no longer sign up or
order a free server. A network pattern blocks free orders from the whole
network, and a server name pattern refuses free servers with that name.
``hours`` sets how long the block lasts (1 to 8760), and null makes it
last until someone deletes the rule. If your brand already has a rule for
the value, it becomes this block. Needs an org owner or admin; answers the
pattern row, and 404 for a pattern that is not your brand's.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `pattern_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `hours` | integer or null | yes |
| `reason` | string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Dismiss a pattern for 1 to 90 days {#op-post-api-v1-orgs-org-slug-staff-abuse-patterns-pattern-id-dismiss}

`POST /api/v1/orgs/{org_slug}/staff/abuse/patterns/{pattern_id}/dismiss`

Dismiss a pattern for 1 to 90 days.

The pattern reads dismissed and does not open again before then, however
many accounts share the value. After that date it opens again only when
the value is over its threshold again. A rule the pattern already has
stays in place; delete the rule to let the value back in. Needs an org
owner or admin; answers the pattern row, and 404 for a pattern that is not
your brand's.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `pattern_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `days` | integer | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### List the email domains, networks and server names your brand blocks or allows {#op-get-api-v1-orgs-org-slug-staff-abuse-rules}

`GET /api/v1/orgs/{org_slug}/staff/abuse/rules`

List the email domains, networks and server names your brand blocks or allows.

The list holds your brand's own rules (``scope`` org) and the rules the
platform set for every brand (``scope`` platform), newest first. You can
read a platform rule and cannot change it; your brand's own rule for the
same value decides first. An expired rule is listed with its
``expires_at`` and no longer applies. Needs Tier 3 support or above.

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `org_slug` | path | string | yes |  |
| `kind` | query | string or null | no | Only rules of this kind: email_domain, ip_cidr or server_name. Any other word answers 422. |
| `limit` | query | integer | no | Rules per page, 1 to 200. Default: `50`. |
| `offset` | query | integer | no | How many rules to skip, for the next page. Default: `0`. |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Block or allow an email domain, a network or a server name for your brand {#op-post-api-v1-orgs-org-slug-staff-abuse-rules}

`POST /api/v1/orgs/{org_slug}/staff/abuse/rules`

Block or allow an email domain, a network or a server name for your brand.

``kind`` is email_domain, ip_cidr or server_name, and ``action`` is block
(the default) or allow; an ip_cidr rule may also be nonresidential, which
treats the network as hosting. A blocked email domain refuses sign-ups
and free orders, and covers its subdomains. A blocked network refuses
free orders from it. A blocked server name refuses free servers with that
name, whatever number follows it. ``hours`` makes the rule expire; null
keeps it until someone deletes it. The value is stored normalized (an
email domain in lowercase, an address as its network). Needs an org owner
or admin. Answers the rule row, 409 when your brand already has
a rule for the value, and 422 when the value is not one of its kind.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `kind` | string | yes |
| `value` | string | yes |
| `action` | string | no |
| `reason` | string or null | no |
| `hours` | integer or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Delete one of your brand's rules, so the value it matched is let in again {#op-delete-api-v1-orgs-org-slug-staff-abuse-rules-rule-id}

`DELETE /api/v1/orgs/{org_slug}/staff/abuse/rules/{rule_id}`

Delete one of your brand's rules, so the value it matched is let in again.

A pattern that the rule blocked goes back to open. A rule the platform
set for every brand cannot be deleted here and answers 403. Needs an org
owner or admin; 404 for a rule that is neither yours nor the platform's.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `rule_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |