---
title: "Search events"
method: POST
path: "/events/index"
tags: ["Events"]
---

# Search events

`POST /events/index`

## Request body

- object
  - `page` integer, nullable
  - `limit` integer, nullable — Maximum number of results to be returned. Can't be greater than the one set for your role. 0 means maximum.
  - `sort` string, nullable — Field to be used to sort the result
  - `direction` 'asc' | 'desc', nullable — Sort direction of the result
  - `minimal` boolean, nullable — Returns a minimal version of the event, only events with `attributeCount` > 0 will be returned
  - `attribute` string, nullable — Filter events matching the given string with attributes values
  - `eventid` string
  - `datefrom` string, date, nullable — Event creation date is greater or equal
  - `dateuntil` string, date, nullable — Event creation date is less or equal
  - `org` string, nullable — Filter events by matching the creator organisation name
  - `eventinfo` string, nullable — Filter events by matching the event info text
  - `tag` string
  - `tags` TagName[], nullable — Filter events by matching *any* of the event tags of a given list of tag names
  - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
  - `sharinggroup` union
    - string, nullable
    - string, uuid, nullable
  - `analysis` '0' | '1' | '2' — Represents the analysis maturity level. * `0` - Initial * `1` - Ongoing * `2` - Complete
  - `threatlevel` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined
  - `extending` boolean — Whether to include events that are extending another one. If set to 1, only events extending another will be returned. If set to 0, only events that are not extending another will be returned. Omit or [0,1] to disregard extension state.
  - `extended` boolean — Whether to include events that are extended by another one. If set to 1, only events extended by another will be returned. If set to 0, only events that are not extended by another will be returned. Omit or [0,1] to disregard extension state.
  - `email` string, email, nullable — Filter events by matching the event creator user email
  - `hasproposal` string, nullable — Filter events by checking if it has attributes with change proposals. Possible values: `0`, `1`
  - `timestamp` string, nullable — Event timestamp greater or equal
  - `publish_timestamp` string, nullable — Event publish timestamp greater or equal
  - `searchDatefrom` string, nullable — Filters on the date, anything newer than the given date in YYYY-MM-DD format is taken - non-negatable
  - `searchDateuntil` string, nullable — Filters on the date, anything older than the given date in YYYY-MM-DD format is taken - non-negatable

## Response `200`

A list of events with extended properties

- ExtendedEvent[]
  - `id` string
  - `org_id` string
  - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
  - `info` string
  - `orgc_id` string
  - `uuid` string, uuid
  - `date` string
  - `published` boolean
  - `analysis` '0' | '1' | '2' — Represents the analysis maturity level. * `0` - Initial * `1` - Ongoing * `2` - Complete
  - `attribute_count` string
  - `timestamp` string, nullable
  - `sharing_group_id` union
    - string, nullable
    - string, uuid, nullable
  - `proposal_email_lock` boolean
  - `locked` boolean
  - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined
  - `publish_timestamp` string
  - `sighting_timestamp` string
  - `disable_correlation` boolean
  - `extends_uuid` string, nullable
  - `event_creator_email` string, email
  - `Feed` Feed
    - `id` string
    - `name` string
    - `provider` string
    - `url` string
    - `rules` string, nullable — Stringified JSON filter rules.
    - `enabled` boolean
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `tag_id` string
    - `default` boolean
    - `source_format` '1' | 'csv' | 'freetext' | 'misp'
    - `fixed_event` boolean — target_event option might be considered
    - `delta_merge` boolean — Merge attributes (only add new attribute, remove revoked attributes)
    - `event_id` string
    - `publish` boolean
    - `override_ids` boolean — The IDS flags will be set to Off for this feed
    - `settings` string, nullable
    - `input_source` 'local' | 'network' — Specify whether the source (url field) is a directory (local) or a genuine url (network).
    - `delete_local_file` boolean — The IDS flags will be set to Off for this feed
    - `lookup_visible` boolean — The lookup will not be visible in the feed correlation
    - `headers` string, nullable — Headers to be passed with the requests. All separated by
    - `caching_enabled` boolean — The feed is cached
    - `force_to_ids` boolean — The IDS flags will be set to On for this feed
    - `orgc_id` string
    - `cache_timestamp` union
      - string
      - boolean
  - `Org` EventOrganisation
    - `id` string
    - `name` string
    - `uuid` string, uuid
  - `Orgc` EventOrganisation
    - `id` string
    - `name` string
    - `uuid` string, uuid
  - `Attribute` Attribute[]
    - `id` string
    - `event_id` string
    - `object_id` string
    - `object_relation` string, nullable
    - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
    - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
    - `value` string
    - `to_ids` boolean
    - `uuid` string, uuid
    - `timestamp` string, nullable
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `comment` string
    - `deleted` boolean
    - `disable_correlation` boolean
    - `first_seen` union
      - string, nullable
      - string, date-time
    - `last_seen` union
      - string, nullable
      - string, date-time
    - `Tag` Tag[]
      - `id` string
      - `name` string
      - `colour` string
      - `exportable` boolean
      - `org_id` string
      - `user_id` string
      - `hide_tag` boolean
      - `numerical_value` string, nullable
      - `is_galaxy` boolean
      - `is_custom_galaxy` boolean
      - `inherited` integer
    - `Galaxy` Galaxy[]
      - `id` string
      - `uuid` string, uuid
      - `name` string
      - `type` string
      - `description` string
      - `version` string
      - `icon` string
      - `namespace` string
      - `kill_chain_order` object, nullable
  - `ShadowAttribute` Attribute[]
    - `id` string
    - `event_id` string
    - `object_id` string
    - `object_relation` string, nullable
    - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
    - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
    - `value` string
    - `to_ids` boolean
    - `uuid` string, uuid
    - `timestamp` string, nullable
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `comment` string
    - `deleted` boolean
    - `disable_correlation` boolean
    - `first_seen` union
      - string, nullable
      - string, date-time
    - `last_seen` union
      - string, nullable
      - string, date-time
    - `Tag` Tag[]
      - `id` string
      - `name` string
      - `colour` string
      - `exportable` boolean
      - `org_id` string
      - `user_id` string
      - `hide_tag` boolean
      - `numerical_value` string, nullable
      - `is_galaxy` boolean
      - `is_custom_galaxy` boolean
      - `inherited` integer
    - `Galaxy` Galaxy[]
      - `id` string
      - `uuid` string, uuid
      - `name` string
      - `type` string
      - `description` string
      - `version` string
      - `icon` string
      - `namespace` string
      - `kill_chain_order` object, nullable
  - `RelatedEvent` object[]
    - `Event` ExtendedEvent — recursive
  - `Galaxy` Galaxy[]
    - `id` string
    - `uuid` string, uuid
    - `name` string
    - `type` string
    - `description` string
    - `version` string
    - `icon` string
    - `namespace` string
    - `kill_chain_order` object, nullable
  - `Object` Object[]
    - `id` string
    - `name` string
    - `meta-category` string
    - `description` string
    - `template_uuid` string, uuid
    - `template_version` string
    - `event_id` string
    - `uuid` string, uuid
    - `timestamp` string
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `comment` string
    - `deleted` boolean
    - `first_seen` union
      - string, nullable
      - string, date-time
    - `last_seen` union
      - string, nullable
      - string, date-time
    - `Attribute` Attribute[]
      - `id` string
      - `event_id` string
      - `object_id` string
      - `object_relation` string, nullable
      - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
      - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
      - `value` string
      - `to_ids` boolean
      - `uuid` string, uuid
      - `timestamp` string, nullable
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `comment` string
      - `deleted` boolean
      - `disable_correlation` boolean
      - `first_seen` union
        - string, nullable
        - string, date-time
      - `last_seen` union
        - string, nullable
        - string, date-time
      - `Tag` Tag[]
        - `id` string
        - `name` string
        - `colour` string
        - `exportable` boolean
        - `org_id` string
        - `user_id` string
        - `hide_tag` boolean
        - `numerical_value` string, nullable
        - `is_galaxy` boolean
        - `is_custom_galaxy` boolean
        - `inherited` integer
      - `Galaxy` Galaxy[]
        - `id` string
        - `uuid` string, uuid
        - `name` string
        - `type` string
        - `description` string
        - `version` string
        - `icon` string
        - `namespace` string
        - `kill_chain_order` object, nullable
  - `EventReport` EventReport[]
    - `id` string
    - `uuid` string, uuid
    - `event_id` string
    - `name` string
    - `content` string
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `timestamp` string, nullable
    - `deleted` boolean
  - `Tag` Tag[]
    - `id` string
    - `name` string
    - `colour` string
    - `exportable` boolean
    - `org_id` string
    - `user_id` string
    - `hide_tag` boolean
    - `numerical_value` string, nullable
    - `is_galaxy` boolean
    - `is_custom_galaxy` boolean
    - `inherited` integer

## Other responses

- `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.
- `default` — Unexpected API error

---

[API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)