v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB

Risk Intelligence

List all findings of the threat actor.

get/api/v2/riskintelligence/threat-actors/{threatActorId}/findings

Path parameters

threatActorIdinteger required

The id of the threat actor.

Query parameters

companyIdinteger required

The id of the company that includes finding.

page_numberinteger

Example:1

The number of the page requested.

page_size10 | 20 | 30 | 50 | 100 | 250 | 500 | 1000

Example:10

The number of result items in a single response.

Response

Success

Modulestring

The module of this finding. The possible responses are listed below.

DNS Health
Email Security
SSL/TLS Strength
Application Security
DDoS Resiliency
Network Security
Fraudulent Domains
Fraudulent Apps
Credential Mgmt.
IP Reputation
Hacktivist Shares
Social Network
Attack Surface
Brand Monitoring
Patch Management
Web Ranking
Information Disclosure
CDN Security
Website Security

FindingIdinteger

The unique identifier of this finding.

The status of this finding.

Active, means the finding is still active with no review as of yet.
FalsePositive, means the finding is considered to be false alarm.
Suppressed, means the finding is suppressed, similar to FalsePositive.
Acknowledged, means the finding is accepted, for example will not be fixed.
Deleted, means the finding is deleted, similar to FalsePositive.
Remediated, means the finding is mitigated.

FirstSeenDatestring date-time

The date that the finding was found.

UpdateDatestring date-time

The last date that the finding was updated. If the UpdateDate equals to the FirstSeenDate or the UpdateDate is null that means the finding is NEW, otherwise the finding is UPDATED.

Example response

[
  {
    "Module": "Email Security",
    "FindingId": 2590965999,
    "Status": "Active",
    "FirstSeenDate": "2023-08-01T08:30:30.682Z",
    "UpdateDate": "2023-08-01T08:30:30.682Z"
  }
]