Skip to content

List all threat objective data for an organization. Drafts on a threat's inherent score are excluded from the results.

GET
/v1/threats

List all threat levels

object
threat_levels
required
Array<object>

Information relating to a threat and its history.

Threat Levels are typically generated for organizations. Threat Objectives don’t have any universal inherent or without the context of an organization.

object
inherent
required

The inherent scores relating to the threat objective

Array<object>

Contains information about the current scoring of a threat objective.

Inherent scores don’t exist without the context of an organization, and cannot exist without some relationship to a threat objective.

This struct should be refactored at some point to be more generic, because it doesn’t necessarily have to relate to a proposal, nor does this struct need to include the threat_objective_name if not requested alone.

object
created_date
required

The date the score was created.

string format: date-time
id
required

An auto-incrementing PK value that uniquely identifies the score given the threat objective name

integer format: int64
impact
required

The y-axis

string
Allowed values: Very Low Low Medium High Severe
is_draft
required

Determines whether this inherent score should be included in some return types of threat levels. TODO(dsgallups): bad design

boolean
likelihood
required

The x-axis

string
Allowed values: Remote Unlikely Possible Probable Imminent
proposal_action_id
required

The proposal action PK that this score is associated with

integer format: int64
proposal_id
required

The proposal PK that this score is associated with

integer format: int64
threat_objective_name
required

The threat objective PK

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
min_likelihood
required

Used to constrain the threat level from moving to a location that is deemed too risky

string
Allowed values: Remote Unlikely Possible Probable Imminent
name
required

The PK of the threat objective

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud