---
title: "Close threat"
method: POST
path: "/threatmonitoring/threat/close"
tags: ["threatmonitoring"]
---

# Close threat

`POST /threatmonitoring/threat/close`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/threatmonitoring/threat/close`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/threatmonitoring/threat/close/post.ts> (a function with typed inputs; its response is checked against the schema)

Closes a specific threat, identified by UUID, with the given reason. The reason must be one of: false_positive, risk_accepted, remediated.

For reason 'false_positive': No additional parameters are required.
For reason 'risk_accepted': The 'justification' parameter is required and must contain a free-form text explaining why the risk is accepted.
For reason 'remediated': The 'remediation_reason' parameter is required and must be one of: content_removed_or_privatised, affected_users_credentials_reset, system_patched, requested_takedown, compensating_controls, other. If 'other', the 'remediation_description' parameter is also required.

Required API key permissions: `BreachRisk` (select when creating API key in Account Settings)

## Query parameters

- `uuid` string, uuid, required
- `reason` 'false_positive' | 'risk_accepted' | 'remediated', required
- `justification` string
- `remediation_reason` 'content_removed_or_privatised' | 'affected_users_credentials_reset' | 'system_patched' | 'requested_takedown' | 'compensating_controls' | 'other'
- `remediation_description` string

## Response `200`

The closed threat

- CloseThreatV1ResponsePayloadBody
  - `reason` string: The reason the threat was closed
  - `status` string: The status of the threat after closing
  - `uuid` string: The UUID of the threat that was closed

## Other responses

- `404`: There was a problem with the request
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)