Apply a Supply Audit finding
Apply clones targeting and leaves the live campaign alone. Point the next campaign at the new targeting id, or the flagged supply keeps serving.
Published 2026-09-10 · Search job: apply programmatic supply audit exclusion
You apply a Supply Audit finding by creating new targeting. The live campaign does not move.
POST /supply-audit/flags/:id/apply clones one targeting_sets row from the flagged campaign, removes the flagged exchange, placement, or site, marks the flag applied, and returns applied_targeting_id. The response includes live_delivery_changed: false. That field is the contract. Apply never pauses a campaign, never writes to the exchange, and never changes a budget. The local verification command asserts that the source campaign still points at its original targeting.
CLI is ztdsp supply-audit apply --flag <saf_id>. MCP is apply_supply_audit_flag. Dashboard apply uses the same route.
What you do after apply
Point the next campaign at the returned targeting id. Until you do that, the flagged supply can keep appearing in the lookback window. An applied row is a decision record, not proof the waste stopped. The next nightly scan refreshes that row's metrics instead of inserting a duplicate. See Why an applied finding came back open.
Exchange grain is an allowlist. Excluding one exchange means restating every other one. If the campaign had no explicit allowlist, apply falls back to the exchanges observed on the latest covered run and reports narrowed_from_unrestricted. An apply that would empty the allowlist returns 409, because an empty allowlist compiles to an expression that matches no inventory.
Placement and site are blocklists. Adding a key only removes inventory. Domain findings stay advisory until seat-level list objects exist. Placement vs site vs domain is the grain primer.
Keys have to be split
Stored entity keys are composites such as OPENX|ox/558246019 or PUBMATIC|site:pm/1188465. The value the exchange accepts is the part after the pipe. Sending the un-split key compiles to nothing and fails open. Split the key before you exclude is the writeup.
What we will not claim
Apply is not an automatic quality fix. The scan itself stays recommend_only. Domain findings cannot be applied yet. A first production run found $138.53 of flagged spend across 74 findings; only some of that grain is actionable today. Read Scan then exclude before you treat a green dashboard as a cleaned buy.