---
title: "# Custom Action Keyword"
method: POST
path: "/v1/threat-library/actions/custom-keyword"
tags: ["Threats"]
---

# # Custom Action Keyword

`POST /v1/threat-library/actions/custom-keyword`

Generates the detection keyword (query) for a custom action based on the given attack module
and its related fields (file hashes, file name, play process ids, url or action id).
The returned keyword can then be passed to the Create Action endpoint.

## Request body

- object
  - `action_id` integer — Action id (data exfiltration / email modules)
  - `file_name` string — File name (file-based modules)
  - `md5` string — MD5 hash of the file
  - `module` string — Attack module the action belongs to
  - `play_process` integer[] — Play process ids (endpoint modules)
  - `sha1` string — SHA1 hash of the file
  - `sha256` string — SHA256 hash of the file
  - `url` string — URL (URL Filtering module)

## Response `200`

CustomActionKeywordReturnResponse

- CustomActionKeywordOutput
  - `keyword` string

## Other responses

- `422` — validationErrorSwagger is represents the erroneous cases
- `default` — genericErrorSwagger is represents the erroneous cases

---

[API](https://skmtc.net/picussecurity/apis/picus-rest-api.md) · [All operations](https://skmtc.net/picussecurity/apis/picus-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/picussecurity/picus-rest-api/revisions/cb0d02ee28f8/schema)