---
title: "POST /UpdateThreat"
method: POST
path: "/UpdateThreat"
---

# POST /UpdateThreat

`POST /UpdateThreat`

Updates a threat.

## Request body

- object
  - `threatId` string, required — The unique identifier of the threat to update.
  - `agentSpaceId` string, required — The unique identifier of the agent space.
  - `title` string — A short title summarizing the threat.
  - `status` 'OPEN' | 'RESOLVED' | 'DISMISSED' — Status of a threat.
  - `comments` string — Optional customer comment.
  - `statement` string — The updated natural-language threat statement.
  - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO' — Severity level for a threat.
  - `threatSource` string — The updated actor or origin of the threat.
  - `prerequisites` string — The updated conditions required for the threat to be exploitable.
  - `threatAction` string — The updated description of what the threat source can do.
  - `threatImpact` string — The updated direct consequence of the threat action.
  - `impactedGoal` String[] — The updated security goals affected by the threat.
  - `impactedAssets` String[] — The updated list of specific assets affected by the threat.
  - `anchor` object — DFD element that a threat is anchored to.
    - `kind` string — The kind of DFD element.
    - `id` string — The identifier of the DFD element.
    - `packageId` string — The package identifier containing the DFD element.
  - `evidence` ThreatEvidenceShape[] — List of threat evidence.
    - `packageId` string — The package identifier containing the evidence file.
    - `path` string — The file path of the evidence.
  - `recommendation` string — The updated recommended mitigation guidance for this threat.

## Response `200`

Success

- UpdateThreatOutput — Output for the UpdateThreat operation.
  - `threatId` string, required — The unique identifier of the threat.
  - `threatJobId` string, required — The unique identifier of the threat model job the threat belongs to.
  - `title` string — A short title summarizing the threat.
  - `statement` string — The natural-language threat statement.
  - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO' — The severity level of the threat.
  - `status` 'OPEN' | 'RESOLVED' | 'DISMISSED' — The current status of the threat.
  - `comments` string — Optional customer comment on the threat.
  - `stride` StrideCategory[] — The STRIDE categories applicable to this threat.
  - `threatSource` string — The actor or origin of the threat.
  - `prerequisites` string — The conditions required for the threat to be exploitable.
  - `threatAction` string — What the threat source can do.
  - `threatImpact` string — The direct consequence of the threat action.
  - `impactedGoal` String[] — The security goals affected by the threat.
  - `impactedAssets` String[] — The specific assets affected by the threat.
  - `anchor` object — The DFD element this threat is anchored to.
    - `kind` string — The kind of DFD element.
    - `id` string — The identifier of the DFD element.
    - `packageId` string — The package identifier containing the DFD element.
  - `evidence` ThreatEvidenceShape[] — The source code files supporting the threat.
    - `packageId` string — The package identifier containing the evidence file.
    - `path` string — The file path of the evidence.
  - `recommendation` string — The recommended mitigation guidance for this threat.
  - `createdBy` 'CUSTOMER' | 'AGENT' — Who created this threat.
  - `updatedBy` 'CUSTOMER' | 'AGENT' — Who last updated this threat.
  - `createdAt` string, date-time — The date and time the threat was created, in UTC format.
  - `updatedAt` string, date-time — The date and time the threat was last updated, in UTC format.

---

[API](https://skmtc.net/aws/apis/securityagent.md) · [All operations](https://skmtc.net/aws/apis/securityagent/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/securityagent/versions/cad56717d636/schema)