---
title: "Searches through the threat actors."
method: POST
path: "/api/v2/riskintelligence/threat-actors/search"
tags: ["Risk Intelligence"]
---

# Searches through the threat actors.

`POST /api/v2/riskintelligence/threat-actors/search`

Create a search operation for threat actors. This endpoint will not return the list of resulting threat actors, but instead it will return a search key, that can be used to list the threat actors found by using getThreatActors operation. 
 **Attention**: Every unique client id can create a maximum of 100000 search key per day. 
 **Attention**: All array type search criteria may take a maximum of 100000 values each.

## Request body

- object
  - `GenericSearchText` string — A generic search text which will be searched over many of the leak fields.
  - `ThreatActorIds` number[], nullable — The list of threat actor ids
  - `EcosystemIds` number[], nullable — The list of ecosystem ids that the companies are defined under.
  - `ExploitedVulnerability` string — The CVE ID of the vulnerability.
  - `Motivation` string — The Threat actor's motivation.
  - `Name` string — The Threat Actor Name.
  - `Type` string — The Threat Actor type.
  - `OriginCountryCode` string — The name of the individual country.
  - `TargetIndustryCodes` number[], nullable — The list of industry ids that the companies are classified with.
  - `TargetCountryCodes` string[], nullable — The list of countries that the companies belong to in two letters format.
  - `Ttps` string[], nullable — The Tactics, Techniques, and Procedures of the Threat Actor.
  - `CurrentExposureGreaterThan` number — The value of minimum current exposure of the leak. 0 means all findings.
  - `CurrentExposureLessThan` number — The value of maximum current exposure of the leak. 0 means all findings.
  - `FirstSeenGreaterThan` number — The value of minimum year number of the date on which the threat actor was first appeared.
  - `FirstSeenLessThan` number — The value of maximum year number of the date on which the threat actor was first appeared.
  - `LastSeenGreaterThan` number — The value of minimum year number of the date on which the threat actor was last appeared.
  - `LastSeenLessThan` number — The value of maximum year number of the date on which the threat actor was last appeared.

## Response `200`

Success

- object
  - `Key` string, required — A key in GUID format, which points to the newly created threat actors of vulnerability search action. Use this key in getThreatActors action as a URL parameter in order to fetch the results. The key has a life time of 6 hours. A new search operation should be performed when the search keys are expired.

## Other responses

- `400` — BadRequest
- `401` — Unauthorized
- `default` — Failure

---

[API](https://skmtc.net/blackkitetech/apis/black-kite-api.md) · [All operations](https://skmtc.net/blackkitetech/apis/black-kite-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blackkitetech/black-kite-api/revisions/616dfa9b3b1f/schema)