> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aegister.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mark a Cloud Defender detection legit or ban its source

> Decide on a detection from the Detections tab. `legit` says this source's matches of this kind are expected on your site: they stay on record, marked as legit, and are no longer counted or alerted. `ban` blocks the source on this domain for `hours`, or until you remove it; the ban appears in the banned addresses list. Owners and security officers with a live licence.



## OpenAPI

````yaml post /api/v1/cloud-defender/{id}/security-events/{event_id}/verdict
openapi: 3.1.0
info:
  title: Aegister API
  version: 2.10.0
servers: []
security: []
paths:
  /api/v1/cloud-defender/{id}/security-events/{event_id}/verdict:
    post:
      tags:
        - cloud-defender
      summary: Mark a detection legit or ban its source
      description: >-
        `legit`: this source's matches of this kind are expected here; its
        events (now and later) are kept, marked

        "legit by you", and never counted or alerted. `ban`: the source is
        blocked on this domain, for `hours` or until

        removed; the entry links back to this detection.
      operationId: cloud_defender_security_events_verdict_create
      parameters:
        - in: path
          name: event_id
          schema:
            type: integer
          required: true
        - in: path
          name: id
          schema:
            type: integer
          required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                verdict:
                  type: string
                  enum:
                    - legit
                    - ban
                hours:
                  type: integer
                  description: >-
                    Ban only: how long it lasts (1-2160). Absent = until
                    removed.
            examples:
              BanTheSourceForAMonth:
                value:
                  verdict: ban
                  hours: 720
                summary: Ban the source for a month
              MarkItLegit:
                value:
                  verdict: legit
                summary: Mark it legit
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 0
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - []
                  data:
                    type: object
                    properties:
                      verdict:
                        type: string
                        enum:
                          - legit
                          - ban
                      source_ip:
                        type: string
                        description: The detection's source address.
                      family:
                        type: string
                        description: >-
                          The kind of detection the verdict covers (for example
                          `sqli`); empty = every kind.
                      rule:
                        type:
                          - object
                          - 'null'
                        properties:
                          id:
                            type: integer
                          net:
                            type: string
                            description: One address, a v4 /24 or a v6 /64.
                          action:
                            type: string
                            enum:
                              - block
                              - allow
                            description: >-
                              `block`: banned on this domain. `allow`: on its
                              whitelist.
                          source:
                            type: string
                            enum:
                              - manual
                              - auto_ban
                            description: >-
                              `manual`: added by a person (this API, the
                              console's Protection tab or a Ban button).
                              `auto_ban`: banned automatically by Cloud Defender
                              for 24 hours, after a burst of requests it blocked
                              as attacks on this domain.
                          reason:
                            type: string
                          expires_at:
                            type:
                              - string
                              - 'null'
                            format: date-time
                            description: When a ban ends. Null = until removed.
                          created_at:
                            type: string
                            format: date-time
                          created_by:
                            type:
                              - string
                              - 'null'
                            description: The user who added it.
                          event_id:
                            type:
                              - integer
                              - 'null'
                            description: >-
                              The detection a ban came from, while it still
                              exists.
                        description: >-
                          A ban: its entry in the banned addresses. Null for
                          legit.
              examples:
                Banned:
                  value:
                    error: 0
                    messages: []
                    data:
                      verdict: ban
                      source_ip: 203.0.113.7
                      family: sqli
                      rule:
                        id: 41
                        net: 203.0.113.7
                        action: block
                        source: manual
                        reason: ''
                        expires_at: '2026-11-27T09:30:00Z'
                        created_at: '2026-10-28T09:30:00Z'
                        created_by: 00000000-0000-4000-8000-000000000000
                        event_id: 1520
          description: ''
        '400':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 1
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - - Invalid data provided
                        - net_invalid
                        - net_private
                        - net_cloudflare
                        - net_known_good
                        - net_listed
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 1
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - []
          description: ''
        '503':
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: integer
                    description: |-
                      Any value different from 0 indicates an error.  
                      More details can be found in `messages`.
                    minimum: 0
                    maximum: 0
                    examples:
                      - 1
                  messages:
                    type: array
                    description: >-
                      If `error` is `1`, contains zero or more details on the
                      error.
                    examples:
                      - []
          description: ''
      security:
        - ApiKeyAuth: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Aegister-Token

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.