---
title: "GET /app/api/v1/custom-strategies"
method: GET
path: "/app/api/v1/custom-strategies"
tags: ["custom-strategies"]
---

# GET /app/api/v1/custom-strategies

`GET /app/api/v1/custom-strategies`

List all custom strategies. Use is_protected filter to distinguish between user-created and OOTB strategies.

## Query parameters

- `alert_sources` string[]
- `attack_surfaces` string[]
- `is_archived` boolean
- `is_enabled` boolean
- `is_protected` boolean
- `mitre_tactics` string[]
- `search_query` string

## Response `200`

List of custom strategies

- FullCustomStrategy[]
  - `alert_sources` string[]
  - `attack_surfaces` string[]
  - `created_at` string, date-time, required
  - `id` integer, required
  - `instructions` CustomInstruction[], required
    - `content` string, required
    - `created_at` string, date-time, required
    - `id` integer
    - `internal_origin_uuid` string, uuid, nullable, required
    - `strategy_versions` integer[], required
    - `usage_count` integer, required
  - `internal_origin_uuid` string, uuid, required
  - `is_archived` boolean, required
  - `is_enabled` boolean, required
  - `is_latest` boolean, required
  - `is_protected` boolean, required
  - `mitre_tactics` string[]
  - `outcomes` CustomOutcome[], required
    - `conclusions_affected` integer, required
    - `condition` object, required
    - `created_at` string, date-time, required
    - `id` integer
    - `internal_origin_uuid` string, uuid, nullable, required
    - `outcome` 'COMPLETED_BREACHED_CONFIRMED' | 'COMPLETED_BREACHED_SUSPICIOUS' | 'COMPLETED_FALSE_ALERT', required — * `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED * `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS * `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT
    - `strategy_versions` integer[], required
  - `priorities` CustomPriority[], required
    - `created_at` string, date-time, required
    - `id` integer
    - `insight_tag_rule` object, nullable
    - `internal_origin_uuid` string, uuid, nullable, required
    - `outcomes` OutcomesEnum[]
    - `priorities_affected` integer, required
    - `priority` 'informational' | 'notable' | 'urgent', required — * `informational` - Informational * `notable` - Notable * `urgent` - Urgent
    - `ranking` integer
    - `strategy_versions` integer[], required
  - `scenario` string, nullable
  - `title` string, required
  - `total_conclusions_affected` integer, required
  - `total_instructions_used` integer, required
  - `total_priorities_affected` integer, required
  - `updated_at` string, date-time, required
  - `version_id` integer, required

## Other responses

- `401` — Unauthorized
- `403` — Access denied
- `500` — System error
- `503` — System not ready for requests

---

[API](https://skmtc.dev/dropzone/apis/dropzone-ai.md) · [All operations](https://skmtc.dev/dropzone/apis/dropzone-ai/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dropzone/dropzone-ai/revisions/f7323013d0aa/schema)