mastodon-admin

Use the admin API endpoint /api/v1/admin/reports to fetch unresolved reports, classify them against instance rules, then call the account action endpoint to suspend or silence violators and resolve the report. The included mastodon_reports.py script automates this full loop.

Fetch pending accounts with /api/v1/admin/accounts?pending=true, then check invite request text for location signals, match email domains against a disposable domain blocklist, and screen registration IPs against the Tor exit list. Approve, reject, or escalate based on the combined signals.

A 403 with 'outside the authorized scopes' means the OAuth token was created without admin scopes, even if the user is the instance Owner. Register a new OAuth app with admin:read and admin:write scopes and re-authorize to get a working token.

The v1 admin API silently drops the status parameter because it is not in the permitted filter list, returning every active local account instead. Use the legacy boolean pending=true on v1, or switch to the v2 API which accepts status=pending directly.

Yes, post a status with visibility=direct and an @mention of the new user so they receive a notification. Track welcomed account IDs in a state file and skip accounts older than seven days to avoid belated welcomes.

Silence first offenses of hate speech or harassment, since silencing only hides posts from public timelines. Reserve suspension for severe or repeat violations, spam, and illegal content, because suspension deletes posts and is only reversible within about 30 days.