Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.6-beta

Threat Models

Read a workspace's threat models: their components, data flows and STRIDE threats mapped to ATT&CK.

List threat models

GET/api/v1/threat-modelsthreat_models:read

A workspace's threat models, most recently updated first, with counts instead of the full model.

Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
idstring (UUID)
namestring
descriptionstring · nullable
updatedAtstring (ISO 8601)
componentCountinteger
flowCountinteger
threatCountinteger
techniqueIdsstring[]
Every ATT&CK technique the model's threats map to, each once.
Returned as { data: [...] }. Deleted models are left out.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/threat-models?workspaceId=…"
Response
{
  "data": [
    {
      "id": "0b7e…",
      "name": "Payments API",
      "description": "Card capture through settlement.",
      "updatedAt": "2026-10-22T11:30:00.000Z",
      "componentCount": 6,
      "flowCount": 7,
      "threatCount": 14,
      "techniqueIds": ["T1078", "T1110.003", "T1530"]
    }
  ]
}

Get threat model

GET/api/v1/threat-models/{id}threat_models:read

One threat model in full.

Path parameters
idstring (UUID)required
Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
data.idstring (UUID)
data.workspaceIdstring (UUID)
data.namestring
data.descriptionstring · nullable
data.content.zones[]object[]
id, name — the trust zones components sit in.
data.content.components[]object[]
id, name, kind (external | process | store), zone, tech, description, logs[] (the log sources it produces), products[] (named as the CISA KEV catalogue names them), ref (the resource it was drafted from), position.
data.content.flows[]object[]
id, from, to, label — data flows between components.
data.content.threats[]object[]
id, element (a component or flow id), stride (spoofing | tampering | repudiation | information-disclosure | denial-of-service | elevation-of-privilege), statement, attack[] (up to 10 ATT&CK ids), response (detect | control | accept), control.
data.content.notApplicable[]object[]
element, stride, reason — STRIDE questions answered as not applying to that element.
data.content.sourceobject · nullable
What the model was drafted from: kind (terraform | cloudformation | servicenow), name, checkedAt.
data.createdAtstring (ISO 8601)
data.updatedAtstring (ISO 8601)
Returned as { data: { … } }. A model that isn't in the resolved workspace, or was deleted, returns 404 "Threat model not found".
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/threat-models/{id}?workspaceId=…"
Response
{
  "data": {
    "id": "0b7e…",
    "workspaceId": "d41f…",
    "name": "Payments API",
    "description": "Card capture through settlement.",
    "content": {
      "zones": [{ "id": "dmz", "name": "DMZ" }],
      "components": [
        { "id": "api", "name": "Payments API", "kind": "process", "zone": "dmz", "logs": [], "products": [] }
      ],
      "flows": [],
      "threats": [
        {
          "id": "api-brute-force",
          "element": "api",
          "stride": "spoofing",
          "statement": "An attacker sprays passwords against the API's login.",
          "attack": ["T1110.003"],
          "response": "detect"
        }
      ],
      "notApplicable": []
    },
    "createdAt": "2026-10-01T09:00:00.000Z",
    "updatedAt": "2026-10-22T11:30:00.000Z"
  }
}