---
title: "POST /CreateThreatModel"
method: POST
path: "/CreateThreatModel"
---

# POST /CreateThreatModel

`POST /CreateThreatModel`

Creates a new threat model configuration in an agent space. A threat model defines the parameters for automated threat analysis.

## Request body

- object
  - `title` string, required — The title of the threat model.
  - `agentSpaceId` string, required — The unique identifier of the agent space to create the threat model in.
  - `description` string — A description of the application or system being threat modeled.
  - `assets` object — The collection of assets used in a pentest configuration, including endpoints, actors, documents, source code repositories, and integrated repositories.
    - `endpoints` Endpoint[] — The list of endpoints to test during the pentest.
      - `uri` string — The URI of the endpoint.
    - `actors` Actor[] — The list of actors used during penetration testing.
      - `identifier` string — The unique identifier for the actor.
      - `uris` String[] — The list of URIs that the actor targets during testing.
      - `authentication` object — The authentication configuration for the actor.
        - `providerType` 'SECRETS_MANAGER' | 'AWS_LAMBDA' | 'AWS_IAM_ROLE' | 'AWS_INTERNAL' — The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.
        - `value` string — The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.
      - `description` string — A description of the actor.
    - `documents` DocumentInfo[] — The list of documents that provide context for the pentest.
      - `s3Location` string — The Amazon S3 location of the document.
      - `artifactId` string — The unique identifier of the artifact associated with the document.
      - `integratedDocument` object — A reference to a document in an integrated third-party provider.
        - `integrationId` string, required — The identifier of the integration that provides access to the document.
        - `resourceId` string, required — The provider-specific resource identifier for the document.
    - `sourceCode` SourceCodeRepository[] — The list of source code repositories to analyze during the pentest.
      - `s3Location` string — The Amazon S3 location of the source code repository archive.
    - `integratedRepositories` IntegratedRepository[] — The list of integrated repositories associated with the pentest.
      - `integrationId` string, required — The unique identifier of the integration that provides access to the repository.
      - `providerResourceId` string, required — The provider-specific resource identifier for the repository.
  - `scopeDocs` DocumentInfo[] — The scoped documents for the agent to focus on during threat modeling.
    - `s3Location` string — The Amazon S3 location of the document.
    - `artifactId` string — The unique identifier of the artifact associated with the document.
    - `integratedDocument` object — A reference to a document in an integrated third-party provider.
      - `integrationId` string, required — The identifier of the integration that provides access to the document.
      - `resourceId` string, required — The provider-specific resource identifier for the document.
  - `serviceRole` string, required — ARN of an IAM role that the service can assume to access customer resources.
  - `logConfig` object — The Amazon CloudWatch Logs configuration for pentest job logging.
    - `logGroup` string — The name of the CloudWatch log group.
    - `logStream` string — The name of the CloudWatch log stream.
  - `reportDestination` object — Destination for publishing scan reports to an integrated document provider.
    - `integrationId` string — The integration identifier for the document provider.
    - `containerId` string — The container identifier where the report will be published.
    - `parentId` string — The parent document identifier under which the report will be created.
    - `documentId` string — The existing document identifier to update instead of creating a new document.

## Response `200`

Success

- CreateThreatModelOutput — Output for the CreateThreatModel operation.
  - `threatModelId` string, required — The unique identifier of the created threat model.
  - `title` string — The title of the threat model.
  - `agentSpaceId` string — The unique identifier of the agent space that contains the threat model.
  - `description` string — A description of the application or system being threat modeled.
  - `assets` object — The assets included in the threat model.
    - `endpoints` Endpoint[] — The list of endpoints to test during the pentest.
      - `uri` string — The URI of the endpoint.
    - `actors` Actor[] — The list of actors used during penetration testing.
      - `identifier` string — The unique identifier for the actor.
      - `uris` String[] — The list of URIs that the actor targets during testing.
      - `authentication` object — The authentication configuration for the actor.
        - `providerType` 'SECRETS_MANAGER' | 'AWS_LAMBDA' | 'AWS_IAM_ROLE' | 'AWS_INTERNAL' — The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.
        - `value` string — The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.
      - `description` string — A description of the actor.
    - `documents` DocumentInfo[] — The list of documents that provide context for the pentest.
      - `s3Location` string — The Amazon S3 location of the document.
      - `artifactId` string — The unique identifier of the artifact associated with the document.
      - `integratedDocument` object — A reference to a document in an integrated third-party provider.
        - `integrationId` string, required — The identifier of the integration that provides access to the document.
        - `resourceId` string, required — The provider-specific resource identifier for the document.
    - `sourceCode` SourceCodeRepository[] — The list of source code repositories to analyze during the pentest.
      - `s3Location` string — The Amazon S3 location of the source code repository archive.
    - `integratedRepositories` IntegratedRepository[] — The list of integrated repositories associated with the pentest.
      - `integrationId` string, required — The unique identifier of the integration that provides access to the repository.
      - `providerResourceId` string, required — The provider-specific resource identifier for the repository.
  - `scopeDocs` DocumentInfo[] — The scoped documents for the agent to focus on during threat modeling.
    - `s3Location` string — The Amazon S3 location of the document.
    - `artifactId` string — The unique identifier of the artifact associated with the document.
    - `integratedDocument` object — A reference to a document in an integrated third-party provider.
      - `integrationId` string, required — The identifier of the integration that provides access to the document.
      - `resourceId` string, required — The provider-specific resource identifier for the document.
  - `serviceRole` string — The IAM service role used for the threat model.
  - `logConfig` object — The CloudWatch Logs configuration for the threat model.
    - `logGroup` string — The name of the CloudWatch log group.
    - `logStream` string — The name of the CloudWatch log stream.
  - `createdAt` string, date-time — The date and time the threat model was created, in UTC format.
  - `updatedAt` string, date-time — The date and time the threat model was last updated, in UTC format.

---

[API](https://skmtc.net/aws/apis/securityagent.md) · [All operations](https://skmtc.net/aws/apis/securityagent/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/securityagent/versions/cad56717d636/schema)