---
title: "Update Threat Watch configuration"
method: PUT
path: "/threathunting/v1/threatwatch/config"
tags: ["Threat Watch"]
---

# Update Threat Watch configuration

`PUT /threathunting/v1/threatwatch/config`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/config`
- Auth: API key in header `Authorization`

Creates or updates the Threat Watch auto-quarantine configuration for the authenticated organization.

## Request body

- ThreatWatchConfigUpdateParams
  - `autoQuarantineEnabled` boolean, required: Enable or disable auto-quarantine for Threat Watch. Requires Premium SKU license and admin privileges.

## Response `200`

Success

- ThreatWatchConfigUpdateResponse
  - `message` string: Response message indicating the result of the configuration update.
  - `validationFailures` string[]: List of validation failures, if any.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)