---
title: "Get threat model"
method: GET
path: "/api/threat-model"
tags: ["Threat Model"]
---

# Get threat model

`GET /api/threat-model`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/threat-model`
- Auth: HTTP bearer

Get the current threat model for the organization.

## Response `200`

Successful response

- object
  - `threatModel` object, nullable, required: Current threat model for the org, or null if none exists yet
    - `organizationId` string, uuid, required: Organization that owns this threat model
    - `currentVersion` object, required: Current active version for the organization
      - `id` string, uuid, required: Unique identifier for this threat model version
      - `version` integer, required: Monotonic version number
      - `isCurrent` boolean, required: Whether this version is currently active for the organization
      - `authorType` 'ai' | 'user', required: Whether this version was created by AI or a human
      - `authorId` string, uuid, nullable, required: User ID for human edits, or null for AI-authored versions
      - `modelAlias` string, nullable, required: Model alias that produced this version, or null for human edits
      - `changeDescription` string, nullable, required: Short description of why this version was created
      - `createdAt` string, required: Timestamp when this version was created
      - `content` string, required: Full markdown content for this threat model version
  - `generationJob` object, nullable: Active threat model generation job, if one is currently pending or running
    - `id` string, uuid, required: Active threat model generation job ID
    - `status` 'pending' | 'retrying' | 'waiting' | 'in_progress', required: Current active generation job status
    - `createdAt` string, required: Timestamp when the active generation job was created
  - `recentVersionWindow` integer, required: How many recent versions threat model logic typically needs to look at

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)