# POST /api/v1/security/imunify/restore

> Read or act on Imunify360 malware findings

- Group: security
- Tier: W
- Required scope: read:hosting
- Docs: https://api.inleed.com/reference/security/create-imunify-3

## Description

`action=summary` returns protection status and counts; `findings` returns the detected items; `scan` starts an on-demand scan; `ignore` accepts a finding; `restore` puts a quarantined file back and is irreversible — it returns `{status:"confirmation_required", confirmationUrl, …}` and restores nothing on this call. On a node without Imunify360 every action returns `supported:false`.

## Body

- `input` — string (required). A domain, email address, website URL, or Inleed service id — for example example.se, info@example.se or 42976. Resolved to the owning account automatically, and the resolved target is echoed back in the response.
- `action` — enum (required). summary status+counts, findings the items, scan a new scan, ignore a finding, or restore a quarantined file (confirmation-tier). scan/ignore/restore need write:hosting. One of summary, findings, scan, restore, ignore.
- `finding_id` — string. The finding to restore or ignore, from action=findings. Letters, digits and ._- only.
- `limit` — integer. For findings: maximum items to return (1–200). Omit for the node default.
- `path` — string. For scan: an optional path under the account to scan. Omit to scan the account.
- `attempt_key` — string. An idempotency key you choose for a restore. Reusing it within an hour returns the same held restore.

## Request

```bash
curl -X POST "https://mcp.inleed.com/api/v1/security/imunify/restore" \
  -H "Authorization: Bearer inl_live_…" \
  -H "Content-Type: application/json" \
  -d '{"input":"example.se","action":"summary","finding_id":"res_01hx8n3k5p7q9r2s4t6v8w0y44","limit":3,"path":"example.se","attempt_key":"example.se"}'
```

## Errors

- **400**  — codes: invalid_request
- **401** No token was presented, or the token is revoked, expired or unknown. — codes: unauthorized, token_expired, token_revoked
- **403** The token lacks a required scope, or this account does not own the resource. — codes: insufficient_scope, domain_not_owned
- **404** No such resource for this account. — codes: not_found
- **422** Validation error — codes: validation_failed
- **429** The rate limit for this token is exhausted. See `Retry-After`. — codes: rate_limited
- **500** Something went wrong on our side. The failure is logged against `requestId`. — codes: internal_error

## Related

- GET /api/v1/security/imunify — https://api.inleed.com/reference/security/manage-imunify
- GET /api/v1/security/imunify/findings — https://api.inleed.com/reference/security/list-imunify
- POST /api/v1/security/imunify/scan — https://api.inleed.com/reference/security/create-imunify
- POST /api/v1/security/imunify/ignore — https://api.inleed.com/reference/security/create-imunify-2