---
title: "Update a fixed threat-model section"
method: POST
path: "/api/v2/threatModel/updateFixedSection"
tags: ["Threat Model"]
---

# Update a fixed threat-model section

`POST /api/v2/threatModel/updateFixedSection`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/threatModel/updateFixedSection`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Update the markdown content of one of the fixed threat-model sections (Components, Interfaces, Actor Types, Authn/Authz Model, Control Plane, Attacker Types, Application-Specific Attacker Objectives, Datastores, Assumptions, Out of Scope). Section identity is the section row's id — call threatModel.getByApplication first to find it. The content is rendered inside the <threat_model> XML block of investigation, validation, and triage prompts on the next scan, where it gives agents the app-specific security baseline they should reason from. Section type cannot be changed — to change which slot you edit, choose a different sectionId. Requires ORG_EDIT_SAST_CONFIG.

## Request body

- ThreatModelUpdateFixedSectionRequest
  - `organizationId` string: Organization that owns the threat model.
  - `sectionId` string, required: cuid of the ThreatModelFixedSection row. Obtain section ids by calling threatModel.getByApplication; each fixed section has a stable id while its sectionType (COMPONENTS, INTERFACES, etc.) tells you which fixed slot it occupies.
  - `content` string, required: New markdown content for the section. May be empty (for example, to clear an out-of-scope list).

## Response `200`

Fixed section updated

- ThreatModelFixedSectionUpdateResponse
  - `id` string, required
  - `sectionType` 'COMPONENTS' | 'INTERFACES' | 'ACTOR_TYPES' | 'AUTHN_AUTHZ_MODEL' | 'AUTHZ_CODE_PATTERNS' | 'CONTROL_PLANE' | 'ATTACKER_TYPES' | 'APP_ATTACKER_OBJECTIVES' | 'DATASTORES' | 'ASSUMPTIONS' | 'OUT_OF_SCOPE', required: Identifier for one of the fixed threat-model sections. Sections render in this canonical order in the agent prompt and the UI.
  - `content` string, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)