---
title: "Get attribute(s) by value"
method: GET
path: "/attributes/getAttributeByB64Value/{base64Value}"
tags: ["Attributes"]
---

# Get attribute(s) by value

`GET /attributes/getAttributeByB64Value/{base64Value}`

Search for attributes by their value and return full attribute details including ID.
This endpoint allows efficient lookup of attributes directly in the database using indexed columns.
The attribute value must be base64 encoded in the URL path.

**Example usage:**
```bash
# Encode the attribute value to base64
VALUE="192.168.1.1"
BASE64=$(echo -n "$VALUE" | base64 -w0)

# Query the API
curl -H "Authorization: YOUR_API_KEY" \
     -H "Accept: application/json" \
     "https://misp.local/attributes/getid/${BASE64}"
```

## Path parameters

- `base64Value` string, byte, required

## Response `200`

List of matching attributes

- Attribute[]
  - `id` string
  - `event_id` string
  - `object_id` string
  - `object_relation` string, nullable
  - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
  - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
  - `value` string
  - `to_ids` boolean
  - `uuid` string, uuid
  - `timestamp` string, nullable
  - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
  - `sharing_group_id` union
    - string, nullable
    - string, uuid, nullable
  - `comment` string
  - `deleted` boolean
  - `disable_correlation` boolean
  - `first_seen` union
    - string, nullable
    - string, date-time
  - `last_seen` union
    - string, nullable
    - string, date-time
  - `Tag` Tag[]
    - `id` string
    - `name` string
    - `colour` string
    - `exportable` boolean
    - `org_id` string
    - `user_id` string
    - `hide_tag` boolean
    - `numerical_value` string, nullable
    - `is_galaxy` boolean
    - `is_custom_galaxy` boolean
    - `inherited` integer
  - `Galaxy` Galaxy[]
    - `id` string
    - `uuid` string, uuid
    - `name` string
    - `type` string
    - `description` string
    - `version` string
    - `icon` string
    - `namespace` string
    - `kill_chain_order` object, nullable

## Other responses

- `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.
- `404` — Attribute not found or invalid base64 encoding
- `405` — Method not allowed - this endpoint is API only
- `default` — Unexpected API error

---

[API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)