Takedowns Management API

The Takedown Management API provides comprehensive API endpoints for managing takedown requests across different threat types and platforms. This API enables users to create, monitor, and manage takedown requests for malicious content and domains.

Authentication

Check the authentication page to see the available options.

Access and authentication

Takedowns API Base URL

The base URL for the takedown API is https://takedown.bfore.ai/api

Takedown Listing

Retrieves a paginated list of takedown requests

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Query parameters

sinceany ofOptional

string · date-timeOptional

or

nullOptional

untilany ofOptional

string · date-timeOptional

or

nullOptional

brand_idany ofOptional

Filter by one or more brand IDs

integer[]Optional

or

nullOptional

company_idsany ofOptional

integer[]Optional

or

nullOptional

attack_urlany ofOptional

stringOptional

or

nullOptional

brand_nameany ofOptional

stringOptional

or

nullOptional

status_namesany ofOptional

Filter takedown requests by status

Example: initial_phase

or

nullOptional

takedown_typeany ofOptional

Filter takedown requests by type

Example: identified_threat_domain

or

nullOptional

sortany ofOptionalDefault: created

string · enumOptionalPossible values:

or

nullOptional

orderany ofOptionalDefault: descending

string · enumOptionalPossible values:

or

nullOptional

pageinteger · min: 1Optional

Page number

Default: 1

sizeinteger · min: 1 · max: 100Optional

Page size

Default: 50

Responses

200

Successful Response

application/json

totalany ofRequired

integerOptional

or

nullOptional

pageany ofRequired

integer · min: 1Optional

or

nullOptional

sizeany ofRequired

integer · min: 1Optional

or

nullOptional

pagesany ofOptional

integerOptional

or

nullOptional

422

Validation Error

application/json

get

/v2/takedown/list

HTTPcURLJavaScriptPython

GET /v2/takedown/list HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "items": [
    {
      "id": "text",
      "created": "2026-03-28T10:14:31.982Z",
      "attack_url": "text",
      "value": {
        "type": "text",
        "value": "text"
      },
      "brand_name": "text",
      "user_id": "text",
      "description": "text",
      "company_id": 1,
      "status_id": 1,
      "status_name": "text",
      "updated_at": "2026-03-28T10:14:31.982Z",
      "brand_id": 1,
      "attack_id": 1,
      "takedown_type": "text",
      "cancellation_reason": "text",
      "platform": "text",
      "threat_type": "text",
      "rejection_reason": "text",
      "rejection_description": "text"
    }
  ],
  "total": 1,
  "page": 1,
  "size": 1,
  "pages": 1
}

Get Takedown Requests By Id

get

Fetches the details of a takedown request using the provided takedown ID

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Path parameters

takedown_idstringRequired

Responses

200

Successful Response

application/json

or

nullOptional

422

Validation Error

application/json

get

/v2/takedown/{takedown_id}

HTTPcURLJavaScriptPython

GET /v2/takedown/{takedown_id} HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "id": "text",
  "created": "2026-03-28T10:14:31.982Z",
  "attack_url": "text",
  "value": {
    "type": "text",
    "value": "text"
  },
  "brand_name": "text",
  "user_id": "text",
  "description": "text",
  "company_id": 1,
  "status_id": 1,
  "status_name": "text",
  "updated_at": "2026-03-28T10:14:31.982Z",
  "brand_id": 1,
  "attack_id": 1,
  "takedown_type": "text",
  "cancellation_reason": "text",
  "platform": "text",
  "threat_type": "text",
  "rejection_reason": "text",
  "rejection_description": "text"
}

Takedown Creation

Start a takedown from a confirmed attack

Takedowns are automatically initiated when your PreCrime configuration is enabled for automatic takedown processing. For manual takedown management, confirmed attacks information can be retrieved using the /v2/takedown/attacks endpoint.

Confirmed attacks are already undergoing disruption through our Network Disruption Partners and are ready for complete takedown processing. Only attacks with confirmed status are eligible for takedown initiation. This endpoint automatically filters requests to include only confirmed attacks.

Get Attacks

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Query parameters

fromstring · date-timeRequired

untilstring · date-timeRequired

statusany ofOptionalDefault: ["confirmed"]

or

nullOptional

company_idsany ofOptional

integer[]Optional

or

nullOptional

attack_nameany ofOptional

stringOptional

or

nullOptional

sortstring · enumOptionalDefault: updated_atPossible values:

orderstring · enumOptionalDefault: descendingPossible values:

pageinteger · min: 1Optional

Page number

Default: 1

sizeinteger · min: 1 · max: 100Optional

Page size

Default: 50

brand_idany ofOptional

Filter by one or more brand IDs

integer[]Optional

or

nullOptional

protected_asset_idany ofOptional

Filter by one or more brand IDs

integer[]Optional

or

nullOptional

Responses

200

Successful Response

application/json

totalany ofRequired

integerOptional

or

nullOptional

pageany ofRequired

integer · min: 1Optional

or

nullOptional

sizeany ofRequired

integer · min: 1Optional

or

nullOptional

pagesany ofOptional

integerOptional

or

nullOptional

warningany ofOptional

stringOptional

or

nullOptional

422

Validation Error

application/json

get

/v2/takedown/attacks

HTTPcURLJavaScriptPython

GET /v2/takedown/attacks?from=2026-03-28T10%3A14%3A31.982Z&until=2026-03-28T10%3A14%3A31.982Z HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "items": [
    {
      "company_id": 1,
      "protected_asset_id": 1,
      "protected_asset_name": "text",
      "attack_id": 1,
      "attack_name": "text",
      "value": {
        "type": "text",
        "value": "text"
      },
      "detection_date": "2026-03-28T10:14:31.982Z",
      "identification_status": {
        "value": "text",
        "updated_at": "2026-03-28T10:14:31.982Z"
      },
      "score": {
        "value": 1,
        "updated_at": "2026-03-28T10:14:31.982Z"
      },
      "asset_type": "domain",
      "source": "text",
      "takedown": {
        "id": "text",
        "created": "2026-03-28T10:14:31.982Z",
        "updated_at": "2026-03-28T10:14:31.982Z",
        "status": "text",
        "status_id": 1,
        "status_updated_at": "2026-03-28T10:14:31.982Z",
        "cancellation_reason": "text",
        "rejection_reason": "text"
      },
      "resurgent_threat": true
    }
  ],
  "total": 1,
  "page": 1,
  "size": 1,
  "pages": 1,
  "warning": "text"
}

Accept a confirmed attack takedown

post

Accept a takedown for an attack that has been flagged as confirmed by BforeAI.

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Body

application/json

attack_idintegerRequired

brand_idintegerRequired

Responses

200

Takedown successfully initiated

application/json

idstringRequired

createdstring · date-timeRequired

attack_urlany ofOptional

stringOptional

or

nullOptional

brand_nameany ofRequired

stringOptional

or

nullOptional

user_idstringRequired

descriptionstringRequired

company_idany ofOptional

integerOptional

or

nullOptional

status_idintegerRequired

status_namestringRequired

updated_atstring · date-timeRequired

brand_idany ofOptional

integerOptional

or

nullOptional

attack_idany ofOptional

integerOptional

or

nullOptional

takedown_typeany ofOptional

stringOptional

or

nullOptional

cancellation_reasonany ofOptional

stringOptional

or

nullOptional

platformany ofOptional

stringOptional

or

nullOptional

threat_typeany ofOptional

stringOptional

or

nullOptional

rejection_reasonany ofOptional

stringOptional

or

nullOptional

rejection_descriptionany ofOptional

stringOptional

or

nullOptional

404

Not Found - Threat ID not found or no company assigned

422

Validation Error

application/json

post

/v2/takedown/accept

HTTPcURLJavaScriptPython

POST /v2/takedown/accept HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 28

{
  "attack_id": 1,
  "brand_id": 1
}

{
  "id": "text",
  "created": "2026-03-28T10:14:31.982Z",
  "attack_url": "text",
  "value": {
    "type": "text",
    "value": "text"
  },
  "brand_name": "text",
  "user_id": "text",
  "description": "text",
  "company_id": 1,
  "status_id": 1,
  "status_name": "text",
  "updated_at": "2026-03-28T10:14:31.982Z",
  "brand_id": 1,
  "attack_id": 1,
  "takedown_type": "text",
  "cancellation_reason": "text",
  "platform": "text",
  "threat_type": "text",
  "rejection_reason": "text",
  "rejection_description": "text"
}

Request a an infrastructure takedown

Request a takedown for a potential false negative

post

Request a takedown for a domain not yet identified as malicious. If the domain was already detected, a 202 Accepted response will be returned with a message.

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Body

application/json

urlstring · uri · min: 1 · max: 2083Required

brand_idintegerRequired

commentstringRequired

Responses

200

Takedown successfully initiated

application/json

or

202

Takedown accepted but attack was already detected

application/json

400

Bad Request - e.g., brand is not active

404

Not Found - e.g., brand ID does not exist

422

Validation Error

application/json

post

/v2/takedown/request

HTTPcURLJavaScriptPython

POST /v2/takedown/request HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "url": "https://example.com",
  "brand_id": 1,
  "comment": "text"
}

{
  "id": "text",
  "created": "2026-03-28T10:14:31.982Z",
  "attack_url": "text",
  "value": {
    "type": "text",
    "value": "text"
  },
  "brand_name": "text",
  "user_id": "text",
  "description": "text",
  "company_id": 1,
  "status_id": 1,
  "status_name": "text",
  "updated_at": "2026-03-28T10:14:31.982Z",
  "brand_id": 1,
  "attack_id": 1,
  "takedown_type": "text",
  "cancellation_reason": "text",
  "platform": "text",
  "threat_type": "text",
  "rejection_reason": "text",
  "rejection_description": "text"
}

Request a social media takedown

Create a takedown request for social media content

post

Submit a takedown request for a social media threat. Takedowns created via this endpoint will be assigned a 'pending' status by default.

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Body

application/json

threat_typestring · enumRequiredPossible values:

platformstring · enumRequiredPossible values:

malicious_urlstring · uri · min: 1 · max: 2083Required

brand_idintegerRequired

commentany ofOptional

stringOptional

or

nullOptional

company_idany ofOptional

integerOptional

or

nullOptional

Responses

200

Takedown successfully initiated

application/json

idstringRequired

createdstring · date-timeRequired

attack_urlany ofOptional

stringOptional

or

nullOptional

brand_nameany ofRequired

stringOptional

or

nullOptional

user_idstringRequired

descriptionstringRequired

company_idany ofOptional

integerOptional

or

nullOptional

status_idintegerRequired

status_namestringRequired

updated_atstring · date-timeRequired

brand_idany ofOptional

integerOptional

or

nullOptional

attack_idany ofOptional

integerOptional

or

nullOptional

takedown_typeany ofOptional

stringOptional

or

nullOptional

cancellation_reasonany ofOptional

stringOptional

or

nullOptional

platformany ofOptional

stringOptional

or

nullOptional

threat_typeany ofOptional

stringOptional

or

nullOptional

rejection_reasonany ofOptional

stringOptional

or

nullOptional

rejection_descriptionany ofOptional

stringOptional

or

nullOptional

400

Bad Request - e.g., brand is not active

404

Not Found - e.g., brand ID does not exist

422

Validation Error

application/json

post

/v2/takedown/social-media

HTTPcURLJavaScriptPython

POST /v2/takedown/social-media HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 136

{
  "threat_type": "Impersonation",
  "platform": "Facebook",
  "malicious_url": "https://example.com",
  "brand_id": 1,
  "comment": "text",
  "company_id": 1
}

{
  "id": "text",
  "created": "2026-03-28T10:14:31.982Z",
  "attack_url": "text",
  "value": {
    "type": "text",
    "value": "text"
  },
  "brand_name": "text",
  "user_id": "text",
  "description": "text",
  "company_id": 1,
  "status_id": 1,
  "status_name": "text",
  "updated_at": "2026-03-28T10:14:31.982Z",
  "brand_id": 1,
  "attack_id": 1,
  "takedown_type": "text",
  "cancellation_reason": "text",
  "platform": "text",
  "threat_type": "text",
  "rejection_reason": "text",
  "rejection_description": "text"
}

Takedown Cancelation

Cancel an existing takedown request by providing the takedown ID and a valid cancellation reason. Please note that cancellation success depends on the current status of the takedown process and the involvement of third-party entities. While we will attempt to process all cancellation requests, completion cannot be guaranteed due to external dependencies and process constraints.

Cancel a submitted takedown request

post

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Path parameters

takedown_idstringRequired

Body

application/json

cancel_reason_idintegerRequired

descriptionany ofOptional

stringOptional

or

nullOptional

Responses

200

Successful Response

application/json

messagestringRequired

takedown_idstringRequired

new_statusstringRequired

descriptionany ofOptional

stringOptional

or

nullOptional

rejection_reasonany ofOptional

stringOptional

or

nullOptional

422

Validation Error

application/json

post

/v2/takedown/{takedown_id}/cancel

HTTPcURLJavaScriptPython

POST /v2/takedown/{takedown_id}/cancel HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 43

{
  "cancel_reason_id": 1,
  "description": "text"
}

{
  "message": "text",
  "takedown_id": "text",
  "new_status": "text",
  "description": "text",
  "rejection_reason": "text"
}

Reference Data and Configuration

Here you can find utility endpoints that provide the configuration options used in the rest of the API requests.

Get All Statuses

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Query parameters

takedown_typeany ofOptional

Filter by takedown type

stringOptional

or

nullOptional

Responses

200

Successful Response

application/json

idintegerRequired

namestringRequired

descriptionstringRequired

422

Validation Error

application/json

get

/v2/takedown/statuses

HTTPcURLJavaScriptPython

GET /v2/takedown/statuses HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

[
  {
    "id": 1,
    "name": "text",
    "description": "text"
  }
]

Get Takedown Types V2

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Responses

200

Successful Response

application/json

string[]Optional

get

/v2/takedown/takedown_types/

HTTPcURLJavaScriptPython

GET /v2/takedown/takedown_types/ HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

Successful Response

[
  "text"
]

Get Social Media Platform Names

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Responses

200

Successful Response

application/json

itemsstring[]Required

get

/v2/takedown/social_media/platforms

HTTPcURLJavaScriptPython

GET /v2/takedown/social_media/platforms HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

Successful Response

{
  "items": [
    "text"
  ]
}

Get Cancellation Reasons

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Responses

200

Successful Response

application/json

idintegerRequired

reasonstringRequired

is_activebooleanOptionalDefault: true

get

/v2/takedown/cancellation_reasons

HTTPcURLJavaScriptPython

GET /v2/takedown/cancellation_reasons HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

Successful Response

[
  {
    "id": 1,
    "reason": "text",
    "is_active": true
  }
]

Get Threat Types

get

Authorizations

OAuth2PasswordBearerApiKey

OAuth2passwordRequired

Token URL:

Responses

200

Successful Response

application/json

itemsstring[]Required

get

/v2/takedown/social_media/threat_types

HTTPcURLJavaScriptPython

GET /v2/takedown/social_media/threat_types HTTP/1.1
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

Successful Response

{
  "items": [
    "text"
  ]
}