> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tolmo threat-model

> Retrieve threat model pipeline runs and artifacts using tolmo threat-model. Download the latest run or a specific step from a named pipeline scan.

Tolmo's threat model commands let you download artifacts produced by the platform's threat model pipeline — including full run outputs and individual analysis steps. This is useful for reviewing findings offline or feeding them into other tools.

## List pipeline runs

Use `tolmo threat-model list` to see all recorded pipeline runs for your organization. The output shows each scan's ID and its current status, giving you a quick overview of what has run and whether it completed successfully.

```bash theme={null}
tolmo threat-model list
```

## Download run artifacts

Once you know which run you want to inspect, use `tolmo threat-model get` to fetch its artifacts. You can target the latest run, a specific run by ID, or a single analysis step within a run.

**1. Download the latest run**

Run the command without any flags to pull artifacts from the most recent pipeline execution:

```bash theme={null}
tolmo threat-model get
```

**2. Download a specific run by ID**

Pass the scan ID you retrieved from `threat-model list` to download a particular run's artifacts:

```bash theme={null}
tolmo threat-model get --run <scanId>
```

**3. Download a single step**

Use `--step` to narrow the download to one analysis step within the latest run. For example, to pull only the vulnerability qualification step:

```bash theme={null}
tolmo threat-model get --step vuln-qualif
```

## Output options

```bash theme={null}
tolmo threat-model list --json
tolmo threat-model get --out-dir ./review-artifacts
tolmo threat-model get --run <scan-id-prefix> --json
```

The default directory is `./threat-model-<short-scan-id>`. The CLI writes each step into its own directory. `get --json` prints an array of step outputs instead of writing artifact files. Run lookup uses the latest 100 threat-model step summaries, so it may not include older runs.

## Versioned documents through the API

The REST API also exposes generated threat model documents by version. These version numbers are separate from the pipeline scan IDs used by the CLI:

* [List versions](https://docs.tolmo.com/api-reference/threat-models/list-threat-model-versions.md), with `limit` and `offset`.
* [Get the latest document](https://docs.tolmo.com/api-reference/threat-models/get-the-latest-threat-model.md).
* [Get a specific version](https://docs.tolmo.com/api-reference/threat-models/get-a-threat-model-version.md).

A document response includes `version`, `content`, and `createdAt`. Use its version number to pin an archived review to a revision.

## Working with artifacts

After downloading, artifacts are available locally for inspection or further processing.

> [!TIP]
>
> Add `--json` to get machine-readable output, then pipe it to `jq` to filter or extract specific fields. Artifacts are most meaningful when reviewed alongside the corresponding security findings in your Tolmo dashboard, since the platform links each artifact back to its source findings.

## Common use cases

Threat model artifacts fit naturally into several workflows:

* **Automated artifact archiving in CI** — schedule `tolmo threat-model get` in your pipeline to capture and store artifacts after each scan, building a historical record of your threat model evolution.
* **Offline review** — download artifacts before a review session so that security and engineering teams can work through findings without needing live platform access.
* **Importing into other security tools** — consume the JSON output in vulnerability management platforms, ticketing integrations, or custom dashboards that your team already uses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.