> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/apex/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/apex/_mcp/server.

# runThreatModelWorkflow

> Generate a threat model document for a codebase

**`Signature`**

```ts title="Signature"
function runThreatModelWorkflow(
  input: ThreatModelWorkflowInput,
): Promise<ThreatModelWorkflowResult>;
```

Analyzes a codebase with Apex's built-in `threat-model` skill and writes a Markdown threat model to `outputPath`. This is what `pensar threat-model` runs. Pass the result to [`runPentestAgent`](/apex/sdk/reference/run-pentest-agent) as `threatModel` to steer a pentest.

**`Import`**

```ts title="Import"
import { runThreatModelWorkflow } from "@pensar/apex/core/api";
```

## Parameters

**`codebasePath`** `string` — required

Path to the codebase to analyze.

---

**`outputPath`** `string` — required

Where to write the threat model Markdown file.

---

**`model`** `AIModel` — default: claude-sonnet-4-5

Model ID. See [Models](/apex/sdk/configuration#models).

---

**`authConfig`** `AIAuthConfig`

AI provider credentials.

---

**`session`** `SessionInfo`

Session to reuse. One is created when omitted.

---

**`eventBus`** `AgentEventBus`

Streaming events. See [AgentEventBus](/apex/sdk/reference/agent-event-bus).

---

**`abortSignal`** `AbortSignal`

Cancels the run.

---

**`reasoning`** `ReasoningSetting`

Extended-thinking setting. See [Reasoning](/apex/sdk/configuration#reasoning).

---

## Returns

`Promise<ThreatModelWorkflowResult>`

**`outputPath`** `string`

Absolute path of the written threat model.

---

**`session`** `SessionInfo`

The session used, whether provided or created.

---

## Example

**`Threat model, then pentest`**

```ts title="Threat model, then pentest"
import { readFileSync } from "node:fs";
import { buildAuthConfig } from "@pensar/apex/core/ai";
import { runPentestAgent, runThreatModelWorkflow } from "@pensar/apex/core/api";
import { config } from "@pensar/apex/core/config";
import { sessions } from "@pensar/apex/core/session";

const authConfig = buildAuthConfig(await config.get());
const model = "claude-opus-4-6";

const { outputPath } = await runThreatModelWorkflow({
  codebasePath: "./my-app",
  outputPath: "./threat-model.md",
  model,
  authConfig,
});

const target = "http://localhost:3000";
await runPentestAgent({
  target,
  cwd: "./my-app",
  session: await sessions.create({ name: "Threat-model-guided", targets: [target] }),
  model,
  authConfig,
  threatModel: readFileSync(outputPath, "utf8"),
});
```