Admin force-withdraws a comment
PATCH
/reviews/{reviewId}/admin_withdraw
Admin-only force withdrawal that bypasses the frozen-for-writes check. Requires an audit comment explaining the action.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "audit_comment": "Removing PII discovered after the comment window closed."
{
}
Responses
Review withdrawn by admin
application/json
JSON "review": { "id": 1, "action": "comment", "comment": "The check says "verify that TLS 1.2 or greater is being used" but does not specify HOW to verify.", "created_at": "2026-05-19 14:08:17 UTC", "triage_status": "pending", "triage_set_at": "string", "adjudicated_at": "string", "rule_id": 2976, "section": "check_content", "responding_to_review_id": 0, "duplicate_of_review_id": 0, "addressed_by_rule_id": 0, "triage_set_by_id": 0, "name": "Demo Viewer", "author_name": "Demo Viewer", "triager_display_name": "string", "triager_imported": false, "adjudicator_display_name": "string", "adjudicator_imported": false, "commenter_display_name": "Demo Viewer", "commenter_imported": false, "commentable_type": "BaseRule", "responses_count": 0, "rule_displayed_name": "PHOS-03-000001", "author_email": "string", "commenter_email": "string", "reactions": { "up": 1, "down": 0, "mine": "string" } }
{
}