---
title: "Get the threat model for one application"
method: POST
path: "/api/v2/threatModel/getByApplication"
tags: ["Threat Model"]
---

# Get the threat model for one application

`POST /api/v2/threatModel/getByApplication`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/threatModel/getByApplication`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Fetch the customer-editable threat model for one application: the application overview (PersistentSastScanApplicationInfo.llmContext), app-info metadata, the fixed sections (components, interfaces, actor types, authn/authz model, control plane, attacker types, application-specific attacker objectives, datastores, assumptions, out of scope), and any user-added custom sections. Returns threatModel: null for the threat model if the application's first scan hasn't generated one yet — applicationOverview is always returned because llmContext lives on the application row independent of threat-model existence. The application's overview and fixed sections drive ZeroPath's investigation, validation, and triage agents — editing them changes what the next scan finds and how it's triaged.

## Request body

- ThreatModelGetByApplicationRequest
  - `organizationId` string: Organization that owns the application.
  - `applicationInfoId` string, required: cuid of the PersistentSastScanApplicationInfo to load. Obtainable via threatModel.listForRepo or appInfo.get/search.

## Response `200`

The threat model and application overview

- ThreatModelGetByApplicationResponse
  - `threatModel` ThreatModelRecord, required: A single application threat model: fixed sections plus zero or more user-added custom sections.
    - `id` string, required: cuid of the ThreatModel row.
    - `createdAt` string, date-time, required: ISO timestamp the threat model was first generated by the agent. Stable for the application’s lifetime.
    - `updatedAt` string, date-time, required: ISO timestamp of the most recent edit to any section.
    - `agentGeneratedAt` string, date-time, nullable, required: ISO timestamp the scanner agent last wrote section bodies. Distinct from `createdAt`: a model generated once and refreshed twice has one `createdAt` and three successive values here. Null for a model that predates regeneration and has never been refreshed.
    - `evidenceCheckedAt` string, date-time, nullable, required: ISO timestamp of the last comparison between the application's current inventory and the fingerprint the sections were written from. Advanced only when a comparison actually happened, so it distinguishes “checked, nothing had changed” from “nobody has looked”. Null when no comparison has ever been made.
    - `fixedSections` ThreatModelFixedSection[], required: The fixed sections in canonical FixedSectionType order (components, interfaces, actor types, authn/authz model, authz code patterns, control plane, attacker types, application-specific attacker objectives, datastores, assumptions, out of scope).
      - `id` string, required: cuid of this section row.
      - `sectionType` 'COMPONENTS' | 'INTERFACES' | 'ACTOR_TYPES' | 'AUTHN_AUTHZ_MODEL' | 'AUTHZ_CODE_PATTERNS' | 'CONTROL_PLANE' | 'ATTACKER_TYPES' | 'APP_ATTACKER_OBJECTIVES' | 'DATASTORES' | 'ASSUMPTIONS' | 'OUT_OF_SCOPE', required: Identifier for one of the fixed threat-model sections. Sections render in this canonical order in the agent prompt and the UI.
      - `content` string, required: Markdown body. Empty string when the agent has not (yet) populated this slot.
      - `updatedAt` string, date-time, required: ISO timestamp of the most recent edit.
      - `customerEdited` boolean, required: True once a customer has saved this section through the editor or this endpoint. While true, scan-time regeneration never replaces `content`.
      - `customerEditedAt` string, date-time, nullable, required: ISO timestamp a customer last saved this section. Distinct from `updatedAt`, which advances on any write to the row — including the scan-time write that refreshes what the agent would say for a section the customer has pinned. Null while `customerEdited` is false, and for edits made before this was recorded.
      - `updatedByUserName` string, nullable, required: Display name of whoever last saved this section. Null while `customerEdited` is false — nobody has — and also when the edit predates attribution being recorded.
    - `customSections` ThreatModelCustomSection[], required: User-added custom sections in createdAt order.
      - `id` string, required: cuid of this section row.
      - `title` string, required: Section heading.
      - `meaning` string, required: Customer-authored description of what this section captures. Rendered into the agent prompt's <threat_model> block as a <meaning> tag.
      - `content` string, required: Markdown body.
      - `updatedAt` string, date-time, required: ISO timestamp of the most recent edit.
  - `applicationOverview` ThreatModelApplicationOverview, required: Application metadata returned alongside the threat model. The llmContext field is the application overview that is interpolated into every downstream scanner-agent prompt as <llm_context>.
    - `name` string, required: Display name of the application.
    - `directoryPath` string, required: Application root directory relative to the repository root.
    - `llmContext` string, nullable, required: Application overview prose written through to PersistentSastScanApplicationInfo.llmContext. Null when the application identification phase has not produced one yet.
    - `llmContextEdited` boolean, required: True once a customer has saved the overview through the editor or `updateApplicationOverview`. While true, application re-identification never overwrites `llmContext`.
    - `description` string, required: Short application description from the application-info agent.
    - `architecture` string, required: Architecture summary from the application-info agent.
    - `techStack` string[], required: Detected technology and framework names for the application.

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)