---
title: "Get an attribute by ID"
method: GET
path: "/attributes/view/{attributeId}"
tags: ["Attributes"]
---

# Get an attribute by ID

`GET /attributes/view/{attributeId}`

## Path parameters

- `attributeId` union, required
  - string
  - string, uuid

## Response `200`

An attribute

- object
  - `Attribute` Attribute
    - `id` string
    - `event_id` string
    - `object_id` string
    - `object_relation` string, nullable
    - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
    - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
    - `value` string
    - `to_ids` boolean
    - `uuid` string, uuid
    - `timestamp` string, nullable
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `comment` string
    - `deleted` boolean
    - `disable_correlation` boolean
    - `first_seen` union
      - string, nullable
      - string, date-time
    - `last_seen` union
      - string, nullable
      - string, date-time
    - `Tag` Tag[]
      - `id` string
      - `name` string
      - `colour` string
      - `exportable` boolean
      - `org_id` string
      - `user_id` string
      - `hide_tag` boolean
      - `numerical_value` string, nullable
      - `is_galaxy` boolean
      - `is_custom_galaxy` boolean
      - `inherited` integer
    - `Galaxy` Galaxy[]
      - `id` string
      - `uuid` string, uuid
      - `name` string
      - `type` string
      - `description` string
      - `version` string
      - `icon` string
      - `namespace` string
      - `kill_chain_order` object, nullable

## Other responses

- `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.
- `default` — Unexpected API error

---

[API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)