> ## Documentation Index > Fetch the complete documentation index at: https://fdbad6a-heedeo-e1965c.manicule.dev/llms.txt > Use this file to discover all available pages before exploring further. > For every page in one file, fetch https://fdbad6a-heedeo-e1965c.manicule.dev/llms-full.txt (large). > To search and read these docs as tools, connect the MCP server at https://fdbad6a-heedeo-e1965c.manicule.dev/api/mcp. > Every agent surface: https://fdbad6a-heedeo-e1965c.manicule.dev/.well-known/llms-manifest.json # 6. The review page (/the-review-page) Related: [Integrating Heedeo](/index.md), [Connect your app](/connect-your-app.md), [1. Quick start](/quick-start.md), [2. Serve Heedeo from your own domain (do this before you go live)](/serve-heedeo-from-your-own-domain.md), [3. One server call: evaluate or log](/one-server-call.md), [4. The fields to act on](/the-fields-to-act-on.md) Sign in at `https://app.heedeo.com/review` with the account you signed up with (an email code or Google); your email and sessions are under Settings, Advanced, Manage account. The app has four places. Every label on them is fixed per reason or link, and every value is read from your data. * **Home**: the setup until your first event, then the last 7 days: events, people, repeats of once-only actions and open flags, a row per action, and the newest flags. * **Review**: the flagged events, Open and Done, filtered by action. Each row names its strongest reason with a value (`Repeat action · 2nd time`, `Many identities · 3 emails`); the panel says what the flag is about (Account abuse) and shows the event, its signals and the person's browsers. **Confirm flag** (key `c`) records the outcome `abuse` and **Dismiss** (key `d`) records `legit`, the same outcomes as `POST /v1/outcomes` (section 9); either resolves the flag, and reaches your app as `flag.decided` when it has a webhook (section 12). `j` and `k` move between flags. * **Visitors**: one row per person, searchable by id or event id. A person's page shows Account abuse with its score, and their browsers, each with how it joined (First seen, Same email, Same account, Similar device) and how confident Heedeo is that they are one person; **Not them** takes a browser back out (section 7, Merges). Activity counts what the person did over 13 months and Recent shows their newest events, OK or Flagged. **Trust** and **Block** label the person: a label comes back as `listed` on their next event, and Heedeo enforces nothing. More details holds the browser's readings, networks, evidence, old ids and Delete this person. * **API keys**: the publishable key, the main secret key (masked) with **Rotate**, and your other secret keys. **Create secret key** (owners) makes another under a name, such as Staging or Local dev, so one environment's key changes without touching your live one; it is shown once. Each other key lists who made it and when, with its own **Revoke**, which stops it at once. **Rotate** replaces only the main secret key: the old one stops at once, and your other secret keys keep working. A workspace holds up to 20 keys made here or by an assistant; the main key and the keys made through Connect don't count, and Connect is never refused. Members see the keys but cannot create, rotate or revoke them. * **Domains**: serve Heedeo from your own domain, through Cloudflare, your server or a DNS record (section 2), and the allowed origins. It is in the sidebar from your first visit, whether or not you have finished the setup. * **Settings**: **Once per person**, the actions Heedeo flags when the same person does them again (section 3); **How strict**; **Auto-confirm**, off by default: set a score from 1 to 1000. Auto-confirm confirms a new flag at or above its score as abuse, in the day after it is raised, when it is about the person who sent the event and no decision or report has touched it. It leaves for you in Review a related flag, a reopened or reported one, and any where you trust the person, their email or their network and block none of them. A flag it confirms shows as Auto-confirmed under Review, Resolved, with **Undo**. Only flags are ever confirmed, so a low score confirms each flag the rule takes except those your Trust labels cover: on the person, their email or their network, with no Block. A trusted person's flag is still raised and still sent as `flag.created`; a Block on their email or network outweighs the Trust, as it does in the answer's `listed`. Only flags made after you save it are confirmed: flags already waiting are left for you, and so is an event you already reported on. Auto-confirm takes a flag only in the day after it is raised: an older one waits for you, so a Trust you clear more than a day later never has a flag it spared confirmed. Unlike your own Confirm, an auto-confirmed flag does not add `confirmed_abuse` to that person's later events or their neighbours', and Recommend weights does not learn from it: otherwise one false flag would keep confirming itself. Your own report on the same event (`POST /v1/outcomes`) replaces it, and then it counts. **Webhooks**, the endpoints Heedeo tells of changes (section 12). The workspace's name and usage. **Advanced**, closed by default, holds everything else: the Verify, Flag and Block thresholds and per-action thresholds, Weights with Recommend weights and Reset to defaults, the identity step, Merge on, the Merge threshold and Merge reliability, Score browser tampering, Check breach history, Collection (Full or EU, section 7), and Domains and allowed origins.