> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Modify a threat report

> Make changes to an existing threat report via API

The `modify-threat-report` endpoint lets you update a threat report, whether submitted by you or another community member. Only the fields you include in the request body will be changed. Fields you omit are left as-is.

Use it to:

* **Add new evidence:** Update a report with newly discovered IOCs, advisory URLs, or supporting references as your investigation develops.
* **Correct report details:** Fix inaccurate severity assessments, version information, or payload descriptions after initial submission.
* **Expand threat coverage:** Add tags, contributors, or updated publisher information as more becomes known about a threat actor or campaign.

<Note>
  Modified reports go through the community verification process before they are published to the database. This review ensures data quality and prevents false positives. You can track the status of your submissions from your profile on [opensourcemalware.com](https://opensourcemalware.com).
</Note>

**Endpoint**

```text theme={null}
PUT https://api.opensourcemalware.com/functions/v1/modify-threat-report
```

**Required headers**

```text theme={null}
Authorization: Bearer osm_your_token
Content-Type: application/json
```

## Request body

You must include one of the following to identify the threat:

* `threat_id` (the UUID of the threat report)
* `package_name` (optionally combined with `registry`)
* `resource_identifier` (optionally combined with `registry`)

## Response examples

### Success (200)

```text theme={null}
{
  "message": "Threat report updated successfully",
  "threat_id": "123e4567-e89b-12d3-a456-426614174000",
  "updated_fields": ["threat_description", "severity_level"],
  "status": "modified"
}
```

### 401 — No Authorization header

```json theme={null}
{ "error": "Authorization required" }
```

### 401 — Invalid API token

```json theme={null}
{ "error": "Invalid API token" }
```

### 429 — IP rate limit (whitelisted IPs bypass)

```json theme={null}
{ "error": "Rate limit exceeded for your IP address. Please try again later." }
```

### 429 — Modification rate limit (per hour)

```json theme={null}
{ "error": "Rate limit exceeded. Maximum 30 modifications per hour." }
```

<Note>
  30/hour for standard users. This limit may be increased by an admin.
</Note>

### 405 — Method not allowed

```json theme={null}
{ "error": "Method not allowed" }
```

### 400 — No target identifier supplied

```json theme={null}
{ "error": "Missing required field: either threat_id, package_name, or resource_identifier is required" }
```

### 404 — Lookup by `package_name` returned nothing

```json theme={null}
{ "error": "No threat report found for this package name" }
```

### 404 — Lookup by `resource_identifier` returned nothing

```json theme={null}
{ "error": "No threat report found for this resource_identifier" }
```

### 404 — `threat_id` not found

```json theme={null}
{ "error": "Threat report not found" }
```

### 500 — Lookup by package\_name failed

```json theme={null}
{
  "error": "Failed to lookup threat by package name",
  "details": "<postgres error message>"
}
```

### 500 — Lookup by resource\_identifier failed

```json theme={null}
{
  "error": "Failed to lookup threat by resource_identifier",
  "details": "<postgres error message>"
}
```

### 500 — Fetch existing threat failed

```json theme={null}
{
  "error": "Failed to fetch threat report",
  "details": "<postgres error message>"
}
```

### 500 — Version-creation prefetch failed (pro-user edit path)

```json theme={null}
{ "error": "Failed to fetch threat for version creation" }
```

### 500 — Save proposed changes failed (pro-user edit path)

```json theme={null}
{
  "error": "Failed to save proposed changes",
  "details": "<postgres error message>"
}
```

### 500 — Admin/editor threat update failed

```json theme={null}
{
  "error": "Failed to update threat report",
  "details": "<postgres error message>"
}
```

### 500 — Admin/editor threat details update failed

```json theme={null}
{
  "error": "Failed to update threat details",
  "details": "<postgres error message>"
}
```

### 500 — Catch-all

```json theme={null}
{
  "error": "Internal server error",
  "details": "<exception message>"
}
```

## cURL example

```text theme={null}
curl -X PUT "https://api.opensourcemalware.com/functions/v1/modify-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "package_name": "malicious-package",
    "registry": "npm",
    "threat_description": "Updated: Package now includes additional malicious functionality.",
    "severity_level": "critical",
    "payload_description": "Downloads both cryptocurrency miner and keylogger.",
    "tags": ["cryptocurrency", "miner", "keylogger", "updated"]
  }'
```