What this endpoint does

Searches Recorded Future's threat actor database, which contains over one million entries spanning nation-state groups, financially motivated actors, hacktivists, and individual underground forum or dark web members. Use the name parameter to search across canonical names, common names, and aliases — the search supports advanced prefixes including exact: for exact matches, prefix: for beginning-of-name matches, infix: for substring matches, and relevance: for relevance-sorted results. The limit parameter is required and controls page size. Omitting the name parameter returns all actors in paginated form. Use the threat actor IDs from this endpoint as filter values in Threat Actor Threat Map and Threat Actor Threat Map (Org), and consult Threat Actor Categories to understand category classifications.

Response data

Returns threat actor profiles — each representing either a group (Organization) or individual (Person) in Recorded Future's intelligence. The canonical name may differ from the name you searched for (e.g., searching "APT28" returns the actor canonically named "BlueDelta"), with the common names and aliases providing the full set of known designations across vendors, governments, and research teams. Categories classify the actor's motivation and state sponsorship (e.g., "Nation State Sponsored", "Russia Nation State Sponsored"), which is valuable for attributing incidents and understanding adversary intent. Pagination uses opaque next_offset tokens — pass the value as offset in subsequent requests. The database is very large, so always use name filters for targeted searches rather than paginating through the full dataset.