List takedowns

GET

/core/api/takedowns/

curl --request GET \
  --url 'https://app.nebty.de/core/api/takedowns/?resolution=DOMAIN_SUSPENDED&status=REQUESTED' \
  --header 'Authorization: <Authorization>'

• Production

Returns the takedown cases the API key’s user can see: those they requested and those belonging to a brand they are a member of. Newest first.

Filters: brand (UUID), status, resolution, created_after (inclusive) and created_before (exclusive), both ISO 8601. Invalid values, and created_after not earlier than created_before, are rejected with 400.

Paginated: page and page_size (default 50). On this endpoint a page_size above 100 is rejected with 400 rather than reduced.

A takedown’s status is one of REQUESTED (waiting for approval), OPEN, IN_PROGRESS, PENDING_RESPONSE, CLOSED, FAILED or REJECTED. CLOSED alone does not mean the site was taken down; read resolution for the outcome.

Authorizations

• ApiKeyAuth

Parameters

Query Parameters

brand

string format: uuid

Filter takedowns for a specific brand ID

created_after

string format: date-time

Created at or after this ISO 8601 timestamp (inclusive).

created_before

string format: date-time

Created before this ISO 8601 timestamp (exclusive).

page

integer

A page number within the paginated result set.

page_size

integer

>= 1 <= 100

Items per page, 1–100; default 50. Keep this value unchanged while paging.

resolution

string

>= 1 characters

Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE

Exact outcome. CLOSED alone does not mean successful removal.

• DOMAIN_SUSPENDED - Domain Suspended
• CONTENT_REMOVED - Content Removed
• SERVER_HOLD - Server Hold
• VOLUNTARY_TAKEDOWN - Voluntary Takedown
• UNRESOLVED - Unresolved
• FALSE_POSITIVE - False Positive

status

string

>= 1 characters

Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED

• REQUESTED - Requested (Pending Approval)
• OPEN - Open
• IN_PROGRESS - In Progress
• PENDING_RESPONSE - Pending Response
• CLOSED - Closed
• FAILED - Failed
• REJECTED - Rejected

Responses

200

Media typeapplication/json

object

count

required

integer

next

string format: uri

nullable

previous

string format: uri

nullable

results

required

Array<object>

Serializer for takedown request details.

object

id

required

string format: uuid

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

requesting_user_email

required

string

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

brand_display

required

string

nullable

brand_name

Legacy free-text brand name (deprecated, use brand FK instead)

string

nullable <= 255 characters

status

required

Current status of the takedown request

• REQUESTED - Requested (Pending Approval)
• OPEN - Open
• IN_PROGRESS - In Progress
• PENDING_RESPONSE - Pending Response
• CLOSED - Closed
• FAILED - Failed
• REJECTED - Rejected

string

Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED

status_display

required

string

is_open

required

boolean

closed_at

required

Timestamp when the takedown case was closed.

string format: date-time

nullable

closed_at_source

required

One of:

string

• MEASURED - Measured at closure
• DERIVED_FROM_EVENT - Derived from status-change event
• DERIVED_FROM_NOTE - Derived from last case note (±1 day)

string

Allowed values: MEASURED DERIVED_FROM_EVENT DERIVED_FROM_NOTE

unknown

How closed_at was arrived at: MEASURED (stamped at closure or entered by staff), DERIVED_FROM_EVENT (reconstructed from the status-change audit event, exact), DERIVED_FROM_NOTE (reconstructed from the last case note, +/-1 day), or blank when no closing date is known. Reports averaging resolution time should state how many inputs were reconstructed.

• MEASURED - Measured at closure
• DERIVED_FROM_EVENT - Derived from status-change event
• DERIVED_FROM_NOTE - Derived from last case note (±1 day)

Allowed values: ""

resolution

required

One of:

string

• DOMAIN_SUSPENDED - Domain Suspended
• CONTENT_REMOVED - Content Removed
• SERVER_HOLD - Server Hold
• VOLUNTARY_TAKEDOWN - Voluntary Takedown
• UNRESOLVED - Unresolved
• FALSE_POSITIVE - False Positive

string

Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE

unknown

Outcome of the takedown case.

• DOMAIN_SUSPENDED - Domain Suspended
• CONTENT_REMOVED - Content Removed
• SERVER_HOLD - Server Hold
• VOLUNTARY_TAKEDOWN - Voluntary Takedown
• UNRESOLVED - Unresolved
• FALSE_POSITIVE - False Positive

nullable

resolution_display

required

string

nullable

registrar

Domain registrar, e.g. ‘Openprovider’, ‘Sav.com’

string

nullable <= 255 characters

domain_created_at

Domain registration date from WHOIS.

string format: date

nullable

domain_expires_at

Domain expiry date from WHOIS.

string format: date

nullable

domain_status

WHOIS status, e.g. ‘clientTransferProhibited’, ‘serverHold’

string

nullable <= 255 characters

ip_address

Resolved IP address (may be proxy IP).

string

nullable

origin_ip

Real server IP behind CDN/proxy.

string

nullable

asn

AS number, e.g. ‘AS13335’

string

nullable <= 20 characters

hosting_provider

Hosting provider, e.g. ‘Hostinger’, ‘Hetzner’

string

nullable <= 255 characters

cdn_proxy

CDN/proxy provider, e.g. ‘Cloudflare’

string

nullable <= 255 characters

is_proxied

Whether the domain is behind a CDN/proxy.

boolean

backend_provider

Backend service, e.g. ‘Supabase’, ‘Vercel’

string

nullable <= 255 characters

backend_project_id

Project ID at backend provider.

string

nullable <= 255 characters

ssl_issued_at

SSL certificate issue date.

string format: date

nullable

ssl_expires_at

SSL certificate expiry date.

string format: date

nullable

ssl_issuer

Certificate issuer, e.g. ‘Let’s Encrypt’, ‘Cloudflare’

string

nullable <= 255 characters

a_entry

DNS A record information (DEPRECATED - use dns_raw)

string

nullable

ns_entry

DNS NS record information (DEPRECATED - use dns_raw)

string

nullable

dns_raw

Full DNS records as JSON. Expected structure: {“a”: […], “aaaa”: […], “cname”: […], “mx”: […], “ns”: […], “txt”: […], “soa”: […], “caa”: […]}

nullable

virustotal_score

Score, e.g. ‘16/93’

string

nullable <= 20 characters

virustotal_url

Link to VirusTotal report.

string format: uri

nullable <= 200 characters

urlscan_url

Link to urlscan.io result.

string format: uri

nullable <= 200 characters

screenshot_url

URL to screenshot in Hetzner S3 Object Storage.

string format: uri

nullable <= 2000 characters

screenshot_taken_at

When the screenshot was taken.

string format: date-time

nullable

abuse_contacts

required

Array<object>

Serializer for abuse contact details.

object

id

required

string format: uuid

contact_type

required

• REGISTRAR - Registrar
• HOSTING - Hosting Provider
• CDN - CDN / Proxy
• BACKEND - Backend Service
• REGISTRY - Domain Registry
• OTHER - Other

string

Allowed values: REGISTRAR HOSTING CDN BACKEND REGISTRY OTHER

contact_type_display

required

string

provider_name

required

Provider name, e.g. ‘Cloudflare’, ‘Openprovider’

string

<= 255 characters

abuse_email

Abuse email address.

string format: email

nullable <= 254 characters

abuse_form_url

URL to abuse report form.

string format: uri

nullable <= 200 characters

report_status

• NOT_SENT - Not Sent
• SENT - Sent
• ACKNOWLEDGED - Acknowledged
• ACTION_TAKEN - Action Taken
• REJECTED - Rejected
• NO_RESPONSE - No Response

string

Allowed values: NOT_SENT SENT ACKNOWLEDGED ACTION_TAKEN REJECTED NO_RESPONSE

report_status_display

required

string

reported_at

string format: date-time

nullable

response_received_at

string format: date-time

nullable

case_reference

Provider case reference, e.g. ‘Case 00954977’

string

nullable <= 255 characters

notes

string

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

blacklist_submissions

required

Array<object>

Serializer for blacklist submission details.

object

id

required

string format: uuid

tier

required

• P1 - P1 - Immediate (GSB, Netcraft, SmartScreen)
• P2 - P2 - Distribution (Spamhaus, Openphish, SpamCop)
• P3 - P3 - Prevention (VirusTotal, Symantec, ScamAdviser)

string

Allowed values: P1 P2 P3

tier_display

required

string

service_name

required

Blacklist service name, e.g. ‘Google Safe Browsing’, ‘Spamhaus’

string

<= 255 characters

submission_url

URL for submission.

string format: uri

nullable <= 200 characters

status

• PENDING - Pending
• SUBMITTED - Submitted
• LISTED - Listed
• REJECTED - Rejected

string

Allowed values: PENDING SUBMITTED LISTED REJECTED

status_display

required

string

submitted_at

string format: date-time

nullable

confirmed_at

When listing was confirmed.

string format: date-time

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

created_at

required

string format: date-time

updated_at

required

string format: date-time

Example

{
  "count": 123,
  "next": "http://api.example.org/accounts/?page=4",
  "previous": "http://api.example.org/accounts/?page=2",
  "results": [
    {
      "status": "REQUESTED",
      "closed_at_source": "MEASURED",
      "resolution": "DOMAIN_SUSPENDED",
      "abuse_contacts": [
        {
          "contact_type": "REGISTRAR",
          "report_status": "NOT_SENT"
        }
      ],
      "blacklist_submissions": [
        {
          "tier": "P1",
          "status": "PENDING"
        }
      ]
    }
  ]
}

400

Invalid query parameters or request data. Field errors appear directly on the response; malformed JSON has a detail message.

Media typeapplication/json

Any of:

object

object

detail

required

string

object

Field names mapped directly to validation error messages.

object

>= 1 properties

key

additional properties

Any of:

string

string

Array<string>

Array<string>

Example

{
  "target_website": [
    "Target host is not a public address."
  ]
}

401

The API key is missing, invalid, revoked or belongs to an inactive user.

Media typeapplication/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

404

The requested page or record does not exist or cannot be accessed.

Media typeapplication/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

429

Too many requests or failed authentication attempts. Try again later.

Media typeapplication/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}