---
title: "Threat Actor Threat Map for Organization"
method: POST
path: "/map/{orgId}/actors"
tags: ["Actors Threat Map"]
---

# Threat Actor Threat Map for Organization

`POST /map/{orgId}/actors`

Rank threat actors by risk to a specific organization in a multi-org enterprise.

## Path parameters

- `orgId` string, required

## Request body

- ThreatMapRequest — Threat map filters
  - `actors` string[] — An array of threat actor entity IDs. If used, the API response will be limited to only those threat actors whose entity IDs match those found in the array. To lookup a threat actor entity ID, use the /actor/search endpoint.
  - `categories` string[] — An array of threat actor category entity IDs. If used, the API response will be filtered to only those threat actors whose category (e.g., Hacktivist, Financially motivated, Nation-state sponsored) matches those found in the array. Categories must be listed by their Recorded Future Entity ID, which can be found by using the /actor/categories endpoint.
  - `watchlists` string[] — An array of client specific watch list IDs. If used, the API response will be limited to only those threat actors whose link to the threat map is via the watch lists included. To lookup a watch list ID, use the List API.

## Response `200`

OK

- ThreatMapResponse — Threat actor threat map with intent/opportunity scores and log entries for each actor targeting the organization.
  - `data` object, required
    - `threat_map` ThreatActorMapItem[] — Array of threat actor entries with risk assessments.
      - `id` string — Entity ID
      - `name` string — Entity name
      - `alias` string[] — Known aliases of the threat actor, including in other languages
      - `categories` string[]
      - `intent` integer
      - `opportunity` integer
      - `log_entries` LogEntry[]
        - `watchlist` BaseEntityOutput
          - `id` string — Entity ID
          - `name` string — Entity name
        - `entity` BaseEntityOutput
          - `id` string — Entity ID
          - `name` string — Entity name
        - `severity` string
        - `axis` 'opportunity' | 'intent'
        - `date` string, date-time
    - `date` string, date-time — Threat map generation timestamp

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)