---
title: "Get the team's threat protection policy"
method: GET
path: "/team/threat-protection"
tags: ["Threat Protection"]
---

# Get the team's threat protection policy

`GET /team/threat-protection`

## Response `200`

Effective threat protection policy for the team's organization.

- object
  - `success` boolean
  - `data` object
    - `mode` 'off' | 'normal' — Threat protection mode. `off` disables checks; `normal` checks URLs against Google Web Risk (+2 credits per URL scanned).
    - `riskScoreThreshold` integer — Normalized score (0-100) at or above which a classifier verdict is blocked. Lower is stricter.
    - `blacklist` string[] — Exact domains or globs (e.g. `*.example.com`) always blocked, without a classifier call.
    - `whitelist` string[] — Exact domains or globs always allowed. Wins over every other rule.
    - `blockedTlds` string[] — Top-level domains to block outright, lowercase without a leading dot.
    - `failurePolicy` 'open' | 'closed' — Behavior when the classifier is unreachable: `closed` blocks (default), `open` allows.
    - `allowRequestOverrides` boolean — Whether individual requests may pass a `threatProtection` object. When false, such requests are rejected with 403.
    - `configured` boolean — Whether the organization has saved a policy (vs. serving defaults).
    - `updatedAt` string, date-time, nullable

## Other responses

- `403` — Threat protection is not enabled for this team, or a request override was sent while overrides are disabled.

---

[API](https://skmtc.dev/firecrawl/apis/firecrawl-api.md) · [All operations](https://skmtc.dev/firecrawl/apis/firecrawl-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firecrawl/firecrawl-api/revisions/e350fafb5a2a/schema)