# Get Threat Protection Policy (/api-reference/endpoint/threat-protection)

<!-- agent-signals: reading_time_min: 2 · est_tokens: 1000 · updated: 2026-07-30 -->
Related: [Search](/api-reference/endpoint/search.md), [Search Feedback](/api-reference/endpoint/search-feedback.md), [Scrape](/api-reference/endpoint/scrape.md), [Batch Scrape](/api-reference/endpoint/batch-scrape.md), [Get Batch Scrape Status](/api-reference/endpoint/batch-scrape-get.md), [Cancel Batch Scrape](/api-reference/endpoint/batch-scrape-delete.md)

Returns the effective [threat protection](/features/threat-protection) policy for your organization. Enterprise feature; requires the feature to be enabled for your team.

`GET /team/threat-protection`

Get the team's threat protection policy

## OpenAPI

```json
{
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "responses": {
    "200": {
      "description": "Effective threat protection policy for the team's organization.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean",
                "example": true
              },
              "data": {
                "type": "object",
                "properties": {
                  "mode": {
                    "type": "string",
                    "enum": [
                      "off",
                      "normal"
                    ],
                    "description": "Threat protection mode. `off` disables checks; `normal` checks URLs against Google Web Risk (+2 credits per URL scanned).",
                    "example": "normal"
                  },
                  "riskScoreThreshold": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 100,
                    "description": "Normalized score (0-100) at or above which a classifier verdict is blocked. Lower is stricter.",
                    "example": 75
                  },
                  "blacklist": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Exact domains or globs (e.g. `*.example.com`) always blocked, without a classifier call.",
                    "example": [
                      "*.risky.example"
                    ]
                  },
                  "whitelist": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Exact domains or globs always allowed. Wins over every other rule.",
                    "example": [
                      "*.trusted.example"
                    ]
                  },
                  "blockedTlds": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "Top-level domains to block outright, lowercase without a leading dot.",
                    "example": [
                      "zip"
                    ]
                  },
                  "failurePolicy": {
                    "type": "string",
                    "enum": [
                      "open",
                      "closed"
                    ],
                    "description": "Behavior when the classifier is unreachable: `closed` blocks (default), `open` allows.",
                    "example": "closed"
                  },
                  "allowRequestOverrides": {
                    "type": "boolean",
                    "description": "Whether individual requests may pass a `threatProtection` object. When false, such requests are rejected with 403.",
                    "example": true
                  },
                  "configured": {
                    "type": "boolean",
                    "description": "Whether the organization has saved a policy (vs. serving defaults).",
                    "example": true
                  },
                  "updatedAt": {
                    "type": "string",
                    "format": "date-time",
                    "nullable": true
                  }
                }
              }
            }
          }
        }
      }
    },
    "403": {
      "description": "Threat protection is not enabled for this team, or a request override was sent while overrides are disabled."
    }
  }
}
```