---
title: "Query Profiles"
method: POST
path: "/v1/detection/profiles/query"
tags: ["Threat Detection"]
---

# Query Profiles

`POST /v1/detection/profiles/query`

Discover threat detection profiles with continuously-updated indicators and detection rules.

## Request body

- object — Query parameters for filtering automation profiles. At least one of `ids` (non-empty array) or `enterprise` must be provided. An empty body or empty `ids` array will return a 400 error.
  - `ids` ProfileId[] — Profile IDs to filter by. Must be a non-empty array if provided. Required if enterprise is not specified.
  - `enterprise` string
  - `integration` string

## Response `200`

List of threat detection profiles matching the query

- object
  - `items` object[], required
    - `id` string, uuid, required — Identity of an automation profile
    - `name` string, required — Name of the profile
    - `description` string — Description of the profile
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400` — Too many profiles requested

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)