---
title: "Create or update a custom threat-model section"
method: POST
path: "/api/v2/threatModel/upsertCustomSection"
tags: ["Threat Model"]
---

# Create or update a custom threat-model section

`POST /api/v2/threatModel/upsertCustomSection`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/threatModel/upsertCustomSection`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Create or update a custom (user-titled) threat-model section. Custom sections render after the fixed sections in the agent prompt's <threat_model> block and are useful for codebase-specific notes that don't fit the standard taxonomy (e.g. 'Vendor Integrations', 'Compliance Notes'). Pass `id` to update an existing section; omit `id` to create a new one. Sections render in creation order — there is no user-controlled reordering. Requires ORG_EDIT_SAST_CONFIG.

## Request body

- ThreatModelUpsertCustomSectionRequest
  - `organizationId` string: Organization that owns the threat model.
  - `threatModelId` string, required: cuid of the ThreatModel the section belongs to. Returned as `threatModel.id` from threatModel.getByApplication.
  - `id` string: cuid of the existing ThreatModelCustomSection to update. Omit to create a new section.
  - `title` string, required: Section heading. Required and must be non-empty.
  - `meaning` string, required: 1-3 sentence description of what this section captures. Required and must be non-empty. Rendered into the agent prompt's <threat_model> block as a <meaning> tag alongside the section's <content>, so consumer LLMs can interpret what role the section plays in the threat model.
  - `content` string, required: Markdown body for the section. May be empty.

## Response `200`

Custom section created or updated

- ThreatModelCustomSectionUpsertResponse
  - `id` string, required
  - `title` string, required
  - `meaning` string, required
  - `content` string, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)