---
title: "Threat Actor Search"
method: POST
path: "/actor/search"
tags: ["Metadata"]
---

# Threat Actor Search

`POST /actor/search`

Search Recorded Future's threat actor database by name, alias, or classification.

## Request body

- ThreatActorsRequest — JSON object specifying pagination of the threat actor list
  - `name` string — This string value can be used for a case insensitive, free text search of threat actor names, common names, or aliases. For example, using `name":"panda"` will yield a search result with over 300 threat actors that have the word "panda" somewhere in its name, common names, or aliases. Advanced searches are supported using a prefix in the search string. For example, using `"name":"exact:panda"`yields only threat actor(s) whose name is just "Panda". <table> <tr> <th>Prefix</th> <th>Match type</th> <th>Description</th> </tr> <tr> <td>no prefix</td> <td>freetext match (default)</td> <td>Returns threat actors where the search string matches somewhere in a name, a common name or an alias (case-insensitive).</td> </tr> <tr> <td>exact:</td> <td>exact match</td> <td>Returns threat actors where the search string exactly matches a name, a common name or an alias.</td> </tr> <tr> <td>prefix:</td> <td>prefix match</td> <td>Returns threat actors where the search string matches the beginning of a name, a common name or an alias.</td> </tr> <tr> <td>infix:</td> <td>infix match</td> <td>Returns threat actors where the search string is contained anywhere in a name, a common name or an alias.</td> </tr> <tr> <td>relevance:</td> <td>1 word: relevance match<br/> 2+ words: relevance phrase match</td> <td>Returns threat actors that have text attributes relevant to the given search word or search phrase (in the same order). The results are sorted by decreasing relevance.</td> </tr> </table>
  - `limit` integer, required — This integer value sets the upper limit on the number of threat actors returned.
  - `offset` string — This string value should be received in a prior search, and is used to deliver the next set of threat actors in the search response.

## Response `200`

OK

- ThreatActorsResponse — Paginated search results for threat actors.
  - `data` ThreatActorSummary[], required — Array of threat actor objects.
    - `id` string — Entity ID
    - `type` 'Company' | 'Organization' | 'Person' — Entity type (Company, Organization or Person)
    - `attributes` ThreatAttributes
      - `name` string, required
      - `common_names` string[] — Alternative names of the threat actor
      - `alias` string[] — Known aliases of the threat actor, including in other languages
      - `categories` BaseEntityOutput[]
        - `id` string — Entity ID
        - `name` string — Entity name
  - `counts` object — Pagination counts.
    - `returned` integer — Number of results in this response page
    - `total` integer — Total number of matching results across all pages
  - `next_offset` string — Opaque pagination token. Pass as offset in the next request to retrieve the next page.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)