---
title: "Update threat lists"
method: PUT
path: "/firewall/apps/{app_id}/ip-lists"
---

# Update threat lists

`PUT /firewall/apps/{app_id}/ip-lists`

## Request

- Base URL: `https://app.aikido.dev/api/public/v1`
- URL: `https://app.aikido.dev/api/public/v1/firewall/apps/{app_id}/ip-lists`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.aikido.io/api/oauth/token` scopes: `firewall:write`

Update the IP lists configuration for an app including known threat actors and Tor settings. This endpoint supports partial updates - only include the properties you want to modify. Omitted properties will remain unchanged.

## Path parameters

- `app_id` integer, required

## Request body

- object: Supports partial updates - only the properties present in the request will be updated. Properties not included will remain unchanged. At least one of the properties (known_threat_actors, tor) must be provided.
  - `known_threat_actors` object[]
    - `code` string
    - `mode` 'monitor' | 'block': monitor: Subscribe but only monitor, block: Subscribe and block. To ignore a threat actor list, simply omit it from the array.
  - `tor` object
    - `mode` 'ignore' | 'monitor' | 'block': ignore: Unsubscribe, monitor: Subscribe but only monitor, block: Subscribe and block

## Response `200`

The IP lists configuration has been successfully updated

- object
  - `success` boolean: Indicates whether the operation was successful

## Other responses

- `400`: Invalid request body
- `404`: App not found

---

[API](https://skmtc.dev/aikido/apis/aikido-security-api-documentation.md) - [All operations](https://skmtc.dev/aikido/apis/aikido-security-api-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/aikido/apis/aikido-security-api-documentation/revisions/da8691338133?raw)