---
title: "Update threat lists"
method: PUT
path: "/firewall/apps/{app_id}/ip-lists"
---

# Update threat lists

`PUT /firewall/apps/{app_id}/ip-lists`

Update the IP lists configuration for an app including known threat actors and Tor settings. This endpoint supports partial updates - only include the properties you want to modify. Omitted properties will remain unchanged.

## Path parameters

- `app_id` integer, required

## Request body

- object — Supports partial updates - only the properties present in the request will be updated. Properties not included will remain unchanged. At least one of the properties (known_threat_actors, tor) must be provided.
  - `known_threat_actors` object[]
    - `code` string
    - `mode` 'monitor' | 'block' — monitor: Subscribe but only monitor, block: Subscribe and block. To ignore a threat actor list, simply omit it from the array.
  - `tor` object
    - `mode` 'ignore' | 'monitor' | 'block' — ignore: Unsubscribe, monitor: Subscribe but only monitor, block: Subscribe and block

## Response `200`

The IP lists configuration has been successfully updated

- object
  - `success` boolean — Indicates whether the operation was successful

## Other responses

- `400` — Invalid request body
- `404` — App not found

---

[API](https://skmtc.dev/aikido/apis/authorization.md) · [All operations](https://skmtc.dev/aikido/apis/authorization/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/aikido/authorization/revisions/5445e7c21137/schema)