Run Threat Modeling

curl --request POST \
  --url https://api.enkryptai.com/rt/threat-modeling \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "risk_categories": {},
  "compliance_frameworks": [],
  "context": {
    "system_description": "<string>",
    "policy_description": "<string>",
    "policy_rules": [
      {
        "id": "<string>",
        "text": "<string>",
        "risk_category": "<string>",
        "severity": "<string>",
        "frameworks": [
          "<string>"
        ]
      }
    ]
  },
  "generation_config": {
    "dataset_name": "<string>",
    "max_prompts": 250,
    "seed_prompts": [
      {
        "prompt": "<string>"
      }
    ],
    "include_standard_library": true
  },
  "run_name": "<string>",
  "comprehensiveness": "Standard",
  "user_metadata": {}
}
'

import requests

url = "https://api.enkryptai.com/rt/threat-modeling"

payload = {
    "risk_categories": {},
    "compliance_frameworks": [],
    "context": {
        "system_description": "<string>",
        "policy_description": "<string>",
        "policy_rules": [
            {
                "id": "<string>",
                "text": "<string>",
                "risk_category": "<string>",
                "severity": "<string>",
                "frameworks": ["<string>"]
            }
        ]
    },
    "generation_config": {
        "dataset_name": "<string>",
        "max_prompts": 250,
        "seed_prompts": [{ "prompt": "<string>" }],
        "include_standard_library": True
    },
    "run_name": "<string>",
    "comprehensiveness": "Standard",
    "user_metadata": {}
}
headers = {
    "apikey": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {apikey: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    risk_categories: {},
    compliance_frameworks: [],
    context: {
      system_description: '<string>',
      policy_description: '<string>',
      policy_rules: [
        {
          id: '<string>',
          text: '<string>',
          risk_category: '<string>',
          severity: '<string>',
          frameworks: ['<string>']
        }
      ]
    },
    generation_config: {
      dataset_name: '<string>',
      max_prompts: 250,
      seed_prompts: [{prompt: '<string>'}],
      include_standard_library: true
    },
    run_name: '<string>',
    comprehensiveness: 'Standard',
    user_metadata: {}
  })
};

fetch('https://api.enkryptai.com/rt/threat-modeling', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/rt/threat-modeling",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'risk_categories' => [
        
    ],
    'compliance_frameworks' => [
        
    ],
    'context' => [
        'system_description' => '<string>',
        'policy_description' => '<string>',
        'policy_rules' => [
                [
                                'id' => '<string>',
                                'text' => '<string>',
                                'risk_category' => '<string>',
                                'severity' => '<string>',
                                'frameworks' => [
                                                                '<string>'
                                ]
                ]
        ]
    ],
    'generation_config' => [
        'dataset_name' => '<string>',
        'max_prompts' => 250,
        'seed_prompts' => [
                [
                                'prompt' => '<string>'
                ]
        ],
        'include_standard_library' => true
    ],
    'run_name' => '<string>',
    'comprehensiveness' => 'Standard',
    'user_metadata' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "apikey: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/rt/threat-modeling"

	payload := strings.NewReader("{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("apikey", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.enkryptai.com/rt/threat-modeling")
  .header("apikey", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/rt/threat-modeling")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["apikey"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}"

response = http.request(request)
puts response.read_body

{}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

POST

threat-modeling

Run Threat Modeling

curl --request POST \
  --url https://api.enkryptai.com/rt/threat-modeling \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "risk_categories": {},
  "compliance_frameworks": [],
  "context": {
    "system_description": "<string>",
    "policy_description": "<string>",
    "policy_rules": [
      {
        "id": "<string>",
        "text": "<string>",
        "risk_category": "<string>",
        "severity": "<string>",
        "frameworks": [
          "<string>"
        ]
      }
    ]
  },
  "generation_config": {
    "dataset_name": "<string>",
    "max_prompts": 250,
    "seed_prompts": [
      {
        "prompt": "<string>"
      }
    ],
    "include_standard_library": true
  },
  "run_name": "<string>",
  "comprehensiveness": "Standard",
  "user_metadata": {}
}
'

import requests

url = "https://api.enkryptai.com/rt/threat-modeling"

payload = {
    "risk_categories": {},
    "compliance_frameworks": [],
    "context": {
        "system_description": "<string>",
        "policy_description": "<string>",
        "policy_rules": [
            {
                "id": "<string>",
                "text": "<string>",
                "risk_category": "<string>",
                "severity": "<string>",
                "frameworks": ["<string>"]
            }
        ]
    },
    "generation_config": {
        "dataset_name": "<string>",
        "max_prompts": 250,
        "seed_prompts": [{ "prompt": "<string>" }],
        "include_standard_library": True
    },
    "run_name": "<string>",
    "comprehensiveness": "Standard",
    "user_metadata": {}
}
headers = {
    "apikey": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {apikey: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    risk_categories: {},
    compliance_frameworks: [],
    context: {
      system_description: '<string>',
      policy_description: '<string>',
      policy_rules: [
        {
          id: '<string>',
          text: '<string>',
          risk_category: '<string>',
          severity: '<string>',
          frameworks: ['<string>']
        }
      ]
    },
    generation_config: {
      dataset_name: '<string>',
      max_prompts: 250,
      seed_prompts: [{prompt: '<string>'}],
      include_standard_library: true
    },
    run_name: '<string>',
    comprehensiveness: 'Standard',
    user_metadata: {}
  })
};

fetch('https://api.enkryptai.com/rt/threat-modeling', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/rt/threat-modeling",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'risk_categories' => [
        
    ],
    'compliance_frameworks' => [
        
    ],
    'context' => [
        'system_description' => '<string>',
        'policy_description' => '<string>',
        'policy_rules' => [
                [
                                'id' => '<string>',
                                'text' => '<string>',
                                'risk_category' => '<string>',
                                'severity' => '<string>',
                                'frameworks' => [
                                                                '<string>'
                                ]
                ]
        ]
    ],
    'generation_config' => [
        'dataset_name' => '<string>',
        'max_prompts' => 250,
        'seed_prompts' => [
                [
                                'prompt' => '<string>'
                ]
        ],
        'include_standard_library' => true
    ],
    'run_name' => '<string>',
    'comprehensiveness' => 'Standard',
    'user_metadata' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "apikey: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/rt/threat-modeling"

	payload := strings.NewReader("{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("apikey", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.enkryptai.com/rt/threat-modeling")
  .header("apikey", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/rt/threat-modeling")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["apikey"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"risk_categories\": {},\n  \"compliance_frameworks\": [],\n  \"context\": {\n    \"system_description\": \"<string>\",\n    \"policy_description\": \"<string>\",\n    \"policy_rules\": [\n      {\n        \"id\": \"<string>\",\n        \"text\": \"<string>\",\n        \"risk_category\": \"<string>\",\n        \"severity\": \"<string>\",\n        \"frameworks\": [\n          \"<string>\"\n        ]\n      }\n    ]\n  },\n  \"generation_config\": {\n    \"dataset_name\": \"<string>\",\n    \"max_prompts\": 250,\n    \"seed_prompts\": [\n      {\n        \"prompt\": \"<string>\"\n      }\n    ],\n    \"include_standard_library\": true\n  },\n  \"run_name\": \"<string>\",\n  \"comprehensiveness\": \"Standard\",\n  \"user_metadata\": {}\n}"

response = http.request(request)
puts response.read_body

{}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "input": "<unknown>",
      "ctx": {}
    }
  ]
}

Authorizations

apikey

string

header

required

Headers

X-Enkrypt-Policy

string

Name of a saved Code of Conduct policy to test against. The gateway resolves it, renders its rules into context.policy_description (v1 free text, or the v2 Policy Wizard enabled rules joined in their stored order) and records the name on the run as policy_name. This OVERRIDES any context.policy_description sent in the body, so a run is never labelled with one policy but generated from another's text - omit the header to keep your own wording.

Example:

"customer-support-coc"

Body

application/json

POST /v1/threat-modeling payload.

Datagen-only. No model, no attacks. Per payload.md:

risk_categories: { <cat>: {} } OR compliance_frameworks: [...]
context: { system_description?, policy_description? }
generation_config: { max_prompts?, seed_prompts?, include_standard_library? } (dataset_name NOT accepted — you're creating a dataset, not consuming one)

risk_categories

Risk Categories · object | null

Show child attributes

compliance_frameworks

enum<string>[] | null

Available options:

owasp_llm_top10,

eu_ai_act,

nist_ai_rmf,

mitre_atlas,

iso_42001,

aiuc_1

context

Context · object | null

Show child attributes

generation_config

GenerationConfig · object | null

generation_config block per payload.md.

Two mutually-exclusive modes:

Pre-built dataset: dataset_name
On-the-fly generation: max_prompts and/or seed_prompts

Plus an orthogonal include_standard_library toggle (default true).

Show child attributes

run_name

string | null

Required string length: 1 - 200

comprehensiveness

enum<string> | null

How exhaustively to test. Standard runs the normal attack budget and Comprehensive widens it; Low, Medium and High are the equivalent sample-size settings surfaced in the dashboard. Omit to use the service default.

Available options:

Low,

Medium,

High,

Standard,

Comprehensive

Example:

"Standard"

user_metadata

User Metadata · object | null

Response

Successful Response

The response is of type Response Run Threat Modeling V1 Threat Modeling Post · object.