---
title: "Get Threat Watch configuration details"
method: GET
path: "/threathunting/v1/threatwatch/config"
tags: ["Threat Watch"]
---

# Get Threat Watch configuration details

`GET /threathunting/v1/threatwatch/config`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/config`
- Auth: API key in header `Authorization`

Retrieves the Threat Watch auto-quarantine configuration for the authenticated organization. Returns default values if no configuration exists.

## Response `200`

Success

- ThreatWatchConfigResponse
  - `autoQuarantineEnabled` boolean: Indicates whether auto-quarantine is enabled for Threat Watch.
  - `lastUpdated` string: Timestamp of the last configuration update. Format - YYYY-MM-DDTHH:MM:SSZ

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)