---
title: "List applications in a repository with threat-model status"
method: POST
path: "/api/v2/threatModel/listForRepo"
tags: ["Threat Model"]
---

# List applications in a repository with threat-model status

`POST /api/v2/threatModel/listForRepo`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/threatModel/listForRepo`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

List every application identified in a repository together with whether each one has a threat model yet. Use this to discover which applicationInfoIds to pass to the other threat-model tools, or to find apps that haven't had threat-modeling run yet (their first full scan will generate one).

## Request body

- ThreatModelListForRepoRequest
  - `organizationId` string: Organization that owns the repository.
  - `repositoryId` string, required: cuid of the repository to list applications for.

## Response `200`

List of applications in the repository

- ThreatModelRepoListEntry[]
  - `applicationInfoId` string, required: cuid of the PersistentSastScanApplicationInfo. Pass this to the other threat-model tools.
  - `name` string, required: Display name of the application.
  - `directoryPath` string, required: Application root directory relative to the repository root.
  - `hasThreatModel` boolean, required: True when the threat-modeling agent has already run and a ThreatModel exists for this app. False means the next full scan will generate one.

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)