Abuse Response Workflow

How provider teams can use read APIs during abuse investigation while planned write actions remain clearly separated.

Coverage

Item	Status
Review security events	Use deployed route documentation
Review IP blocks	Use deployed route documentation
Review malware findings	Use deployed route documentation
Abuse response write workflow	Use deployed route documentation

Workflow

Confirm each route against the deployed route documentation.
Test with a staging token first.
Use read endpoints to inspect current state before any write operation.
Record the external workflow ID in your own system.
Review jobs, request logs, and audit logs after the workflow runs.

Notes

Do not create production automation around undocumented routes.
Use idempotency keys for write endpoints.
Keep rollback steps documented with the integration runbook.

Diagram

flowchart TD
    A[External System] --> B[Read Current State]
    B --> C{Expected State?}
    C -- No --> D[Stop and Alert]
    C -- Yes --> E[Run Approved Workflow]
    E --> F[Read Jobs and Logs]
    F --> G[Operator Review]

← Security Review Workflow