Warn user (from report)
Reports
Warn user (from report)
Issue a formal warning to the accused user (no ban). Fires a critical push + warning email. OPEN → WARNED. Idempotent.
POST
Warn user (from report)
Overview
Issues a formal warning to the user the report names as the accused. Transitions the report fromOPEN → WARNED and stamps resolvedBy, resolvedAt, resolutionReason = reason. The warning is delivered out-of-band via:
- A
critical-kind push notification — per push notification fan-out, thecriticalkind bypassesnotificationsMutedbecause a moderation action is a safety signal the user must see (QUESTIONS.md §7.4). - A warning email to the accused’s primary email, in parallel with the push.
WARNED report returns the row without re-firing either side-effect. Side-effect failures (FCM down, mail provider down) are logged and swallowed — they never roll back the DB transition (matches the Phase 5/6 push/notification producer policy).
See Admin reports feed.
Authentication
Bearer <accessToken> with scope: 'admin' required.
Path parameters
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
id | string | yes | The report id from the list endpoint. 1..64 chars. | 665a3f1e9c2b0a0001a4d201 |
Query parameters
None.Request body
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
reason | string | yes | 1..1000 chars. Stored on reports.resolutionReason AND surfaced in the warning email + push payload to the accused user. Write this from the user’s perspective — they will read it. | Please stop sending messages after another user asks you to. |
Example payload
Response — 200 OK
Returns the full updated report row.
| Field | Type | Notes |
|---|---|---|
id | string | Report id. |
status | string | Always "WARNED". |
resolvedBy | string | The admin id (from the bearer token). |
resolvedAt | string (ISO 8601) | Server clock at the moment of resolution. |
resolutionReason | string | Echo of the request reason. |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | reason missing, empty, or longer than 1000 chars. |
| 401 | UNAUTHENTICATED | Missing / malformed / expired admin token, or non-admin scope. |
| 403 | FORBIDDEN | Caller is a FINANCE admin. SUPER or MODERATOR required. |
| 404 | NOT_FOUND | No report exists with that id. |
| 409 | STATE_CONFLICT | Report is in DISMISSED or BANNED — terminal states never transition. |
Example error — 400 VALIDATION_FAILED
Side effects
| Effect | Notes |
|---|---|
Report row → WARNED | resolvedBy, resolvedAt, resolutionReason set. |
| Push notification to accused | kind: 'critical'. Bypasses notificationsMuted. Payload includes the moderator’s reason. |
| Email to accused | Sent in parallel to push. Subject + body include the moderator’s reason. |
| Audit row | action: report.warn, targetType: report, targetId: <reportId>. |
Push and email are best-effort — if either fails the failure is logged and the warning still counts (the DB row is
WARNED). The accused user is not silently let off the hook by a flaky FCM token or email provider.See also
- Dismiss report — drop down one severity.
- Ban user (from report) — escalate to terminal.
- Push notification fan-out — the
critical-kind bypass.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Admin Reports → Warn.