---
title: "POST /BatchGetThreats"
method: POST
path: "/BatchGetThreats"
---

# POST /BatchGetThreats

`POST /BatchGetThreats`

Retrieves information about one or more threats.

## Request body

- object
  - `threatIds` String[], required — List of threat IDs.
  - `agentSpaceId` string, required — The unique identifier of the agent space.

## Response `200`

Success

- BatchGetThreatsOutput — Output for the BatchGetThreats operation.
  - `threats` Threat[] — The list of threats that were found.
    - `threatId` string — The unique identifier of the threat.
    - `threatJobId` string — The unique identifier of the threat model job that produced the threat.
    - `title` string — A short title summarizing the threat.
    - `statement` string — The natural-language threat statement.
    - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO' — The severity level of the threat.
    - `status` 'OPEN' | 'RESOLVED' | 'DISMISSED' — The current status of the threat.
    - `comments` string — Optional customer comment on the threat.
    - `threatSource` string — The actor or origin of the threat.
    - `prerequisites` string — The conditions required for the threat to be exploitable.
    - `threatAction` string — What the threat source can do.
    - `threatImpact` string — The direct consequence of the threat action.
    - `impactedGoal` String[] — The security goals affected by the threat.
    - `impactedAssets` String[] — The specific assets affected by the threat.
    - `anchor` object — The DFD element this threat is anchored to.
      - `kind` string — The kind of DFD element.
      - `id` string — The identifier of the DFD element.
      - `packageId` string — The package identifier containing the DFD element.
    - `evidence` ThreatEvidenceShape[] — The source code files supporting the threat.
      - `packageId` string — The package identifier containing the evidence file.
      - `path` string — The file path of the evidence.
    - `stride` StrideCategory[] — The STRIDE categories applicable to this threat.
    - `recommendation` string — The recommended mitigation guidance for this threat.
    - `createdBy` 'CUSTOMER' | 'AGENT' — Who created this threat.
    - `updatedBy` 'CUSTOMER' | 'AGENT' — Who last updated this threat.
    - `createdAt` string, date-time — The date and time the threat was created, in UTC format.
    - `updatedAt` string, date-time — The date and time the threat was last updated, in UTC format.
  - `notFound` String[] — The list of threat identifiers that were not found.

---

[API](https://skmtc.net/aws/apis/securityagent.md) · [All operations](https://skmtc.net/aws/apis/securityagent/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/securityagent/versions/cad56717d636/schema)