v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB

Risk Intelligence

Searches through the threat actors.

Create a search operation for threat actors. This endpoint will not return the list of resulting threat actors, but instead it will return a search key, that can be used to list the threat actors found by using getThreatActors operation. Attention: Every unique client id can create a maximum of 100000 search key per day. Attention: All array type search criteria may take a maximum of 100000 values each.

post/api/v2/riskintelligence/threat-actors/search

Request body

GenericSearchTextstring

A generic search text which will be searched over many of the leak fields.

ThreatActorIdsnumber[] nullable

The list of threat actor ids

EcosystemIdsnumber[] nullable

The list of ecosystem ids that the companies are defined under.

ExploitedVulnerabilitystring

The CVE ID of the vulnerability.

Motivationstring

The Threat actor's motivation.

Namestring

The Threat Actor Name.

Typestring

The Threat Actor type.

OriginCountryCodestring

The name of the individual country.

TargetIndustryCodesnumber[] nullable

The list of industry ids that the companies are classified with.

TargetCountryCodesstring[] nullable

The list of countries that the companies belong to in two letters format.

Ttpsstring[] nullable

The Tactics, Techniques, and Procedures of the Threat Actor.

CurrentExposureGreaterThannumber

The value of minimum current exposure of the leak. 0 means all findings.

CurrentExposureLessThannumber

The value of maximum current exposure of the leak. 0 means all findings.

FirstSeenGreaterThannumber

The value of minimum year number of the date on which the threat actor was first appeared.

FirstSeenLessThannumber

The value of maximum year number of the date on which the threat actor was first appeared.

LastSeenGreaterThannumber

The value of minimum year number of the date on which the threat actor was last appeared.

LastSeenLessThannumber

The value of maximum year number of the date on which the threat actor was last appeared.

Example request

{
  "GenericSearchText": "Oracle",
  "ExploitedVulnerability": "CVE-2013-3893",
  "Motivation": "Information Theft",
  "Name": "Qilin",
  "Type": "APT",
  "OriginCountryCode": "US",
  "TargetCountryCodes": [
    "US"
  ],
  "Ttps": [
    "T1570"
  ]
}

Response

Success

Keystring required

A key in GUID format, which points to the newly created threat actors of vulnerability search action. Use this key in getThreatActors action as a URL parameter in order to fetch the results. The key has a life time of 6 hours. A new search operation should be performed when the search keys are expired.

Example response

{
  "Key": "0f8fad5b-d9cb-469f-a165-70867728950e"
}