A social media platform flags videos for content moderation review. Flagged videos get a property set in the database: "blocked": true. They don't appear publicly until a moderator reviews and approves them.
Users can edit their videos — title, description, tags — via the same PUT endpoint. The developer didn't restrict which fields users can update.
"blocked": false to the request body. The API accepts the field and writes it. The video is now unblocked and publicly visible — without any moderator action. The content that was flagged for removal is live again.Content moderation flags (blocked, suspended, under_review, removed) are administrative properties. They must only be settable by the platform — not by the users whose content is being moderated. Without a strict allowlist on the video update endpoint, every moderation action can be reversed by the person being moderated.