Apply a Supply Audit finding

You apply a Supply Audit finding by creating new targeting. The live campaign does not move.

POST /supply-audit/flags/:id/apply clones one targeting_sets row from the flagged campaign, removes the flagged exchange, placement, or site, marks the flag applied, and returns applied_targeting_id. The response includes live_delivery_changed: false. That field is the contract. Apply never pauses a campaign, never writes to the exchange, and never changes a budget. The source campaign keeps its original targeting.

Over MCP, ask your agent to call apply_supply_audit_flag with the saf_ id. Dashboard apply uses the same route.

Point the next campaign at the returned targeting id. Until you do that, the flagged supply can keep appearing in the lookback window. An applied row is a decision record, not proof the waste stopped. The next nightly scan refreshes that row's metrics instead of inserting a duplicate. See Why an applied finding came back open.

Excluding an exchange works through an allowlist: excluding one exchange means restating every other one. If the campaign had no explicit allowlist, apply falls back to the exchanges observed on the latest covered run and reports narrowed_from_unrestricted. An apply that would empty the allowlist returns 409, because an empty allowlist compiles to an expression that matches no inventory.

Placement and site exclusions are blocklists. Adding one only removes inventory. Domain findings stay advisory for now, because excluding a domain needs a list object on the exchange that the product cannot create yet. Placement vs site vs domain explains the difference.

Stored finding keys are composites such as OPENX|ox/558246019 or PUBMATIC|site:pm/1188465. The exchange accepts only the part after the pipe, and that is what apply sends. An un-split key would match nothing, so the placement would keep serving while the finding read as excluded. Split the key before you exclude is the writeup.

Apply is not an automatic quality fix. The scan itself stays recommend_only. Domain findings cannot be applied yet. A first production run found $138.53 of flagged spend across 74 findings; only some of it can be acted on today. Read Scan then exclude before you treat a green dashboard as a cleaned buy.