# Update Threat Protection Policy (/api-reference/endpoint/threat-protection-update)

<!-- agent-signals: reading_time_min: 3 · est_tokens: 1647 · updated: 2026-07-30 -->
Related: [Search](/api-reference/endpoint/search.md), [Search Feedback](/api-reference/endpoint/search-feedback.md), [Scrape](/api-reference/endpoint/scrape.md), [Batch Scrape](/api-reference/endpoint/batch-scrape.md), [Get Batch Scrape Status](/api-reference/endpoint/batch-scrape-get.md), [Cancel Batch Scrape](/api-reference/endpoint/batch-scrape-delete.md)

Full-document update of your organization's [threat protection](/features/threat-protection) policy. Unspecified fields reset to defaults. Team admins only.

`PUT /team/threat-protection`

Full-document update. Unspecified fields reset to defaults. Enterprise feature, team admins only.

## OpenAPI

```json
{
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "required": [
            "mode"
          ],
          "properties": {
            "mode": {
              "type": "string",
              "enum": [
                "off",
                "normal"
              ],
              "description": "Threat protection mode. `off` disables checks; `normal` checks URLs against Google Web Risk (+2 credits per URL scanned).",
              "example": "normal"
            },
            "riskScoreThreshold": {
              "type": "integer",
              "minimum": 0,
              "maximum": 100,
              "description": "Normalized score (0-100) at or above which a classifier verdict is blocked. Lower is stricter.",
              "example": 75
            },
            "blacklist": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "Exact domains or globs (e.g. `*.example.com`) always blocked, without a classifier call.",
              "example": [
                "*.risky.example"
              ]
            },
            "whitelist": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "Exact domains or globs always allowed. Wins over every other rule.",
              "example": [
                "*.trusted.example"
              ]
            },
            "blockedTlds": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "Top-level domains to block outright, lowercase without a leading dot.",
              "example": [
                "zip"
              ]
            },
            "failurePolicy": {
              "type": "string",
              "enum": [
                "open",
                "closed"
              ],
              "description": "Behavior when the classifier is unreachable: `closed` blocks (default), `open` allows.",
              "example": "closed"
            },
            "allowRequestOverrides": {
              "type": "boolean",
              "description": "Whether individual requests may pass a `threatProtection` object. When false, such requests are rejected with 403.",
              "example": true
            }
          }
        }
      }
    }
  },
  "responses": {
    "200": {
      "description": "Effective threat protection policy for the team's organization.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean",
                "example": true
              },
              "data": {
                "type": "object",
                "properties": {
                  "mode": {
                    "type": "string",
                    "enum": [
                      "off",
                      "normal"
                    ],
                    "description": "Threat protection mode. `off` disables checks; `normal` checks URLs against Google Web Risk (+2 credits per URL scanned).",
                    "example": "normal"
                  },
                  "riskScoreThreshold": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 100,
                    "description": "Normalized score (0-100) at or above which a classifier verdict is blocked. Lower is stricter.",
                    "example": 75
                  },
                  "blacklist": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Exact domains or globs (e.g. `*.example.com`) always blocked, without a classifier call.",
                    "example": [
                      "*.risky.example"
                    ]
                  },
                  "whitelist": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Exact domains or globs always allowed. Wins over every other rule.",
                    "example": [
                      "*.trusted.example"
                    ]
                  },
                  "blockedTlds": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Top-level domains to block outright, lowercase without a leading dot.",
                    "example": [
                      "zip"
                    ]
                  },
                  "failurePolicy": {
                    "type": "string",
                    "enum": [
                      "open",
                      "closed"
                    ],
                    "description": "Behavior when the classifier is unreachable: `closed` blocks (default), `open` allows.",
                    "example": "closed"
                  },
                  "allowRequestOverrides": {
                    "type": "boolean",
                    "description": "Whether individual requests may pass a `threatProtection` object. When false, such requests are rejected with 403.",
                    "example": true
                  },
                  "configured": {
                    "type": "boolean",
                    "description": "Whether the organization has saved a policy (vs. serving defaults).",
                    "example": true
                  },
                  "updatedAt": {
                    "type": "string",
                    "format": "date-time",
                    "nullable": true
                  }
                }
              }
            }
          }
        }
      }
    },
    "400": {
      "description": "Invalid policy document."
    },
    "403": {
      "description": "Threat protection is not enabled for this team, or a request override was sent while overrides are disabled."
    }
  }
}
```