proposals review
Record your organization’s decision on a proposal that is waiting on you — the same queue
the Review page shows and reports list --needs-customer-review returns.
A review cannot be undone through the API. approve blocks the asset, and because assets
are unique on type and content, that status is global rather than scoped to your
organization. The command asks for confirmation unless you pass --yes, and each
organization is capped at 10 reviews per day across all of its API credentials.
Options
The three decisions
watchlist is a flavor of rejection rather than a separate outcome — it is stored as a
REJECT review with the asset watchlisted, which is exactly what the Review page does.
That is why a successful watchlist comes back with review.decision: "REJECT" and
watchlisted: true.
Block labels
--label is required when approving. Quote it, since every value contains a space:
"General Phishing", "Brand Impersonation", "Employee Impersonation",
"Fake Employee", "Targeting Org Users", "C2 Server", "False Positive".
Labels that name a specific target — Brand Impersonation and Employee Impersonation — also
need --brand-id.
Finding a proposal to review
Both IDs come from the reports listing. Ask for the proposals waiting on you, then read
proposals[].id and proposals[].asset.id:
Examples
Notes
- Reviews must be attributed to a customer-role member of the organization. Staff
credentials are refused with exit code
5.
- A
403 from a safety check means the decision needs a person, not that your integration
is broken. Log the proposal ID and move on rather than retrying.
- A
409 means either the asset does not match the proposal or the proposal is already
resolved. Re-read the proposal instead of retrying with the same body.
- Not every asset type can be watchlisted. Types the watchlist cannot re-check are refused
rather than silently skipped.
