Threat Actor Search

post

https://api.recordedfuture.com/threat/actor/search

Search Recorded Future's threat actor database by name, alias, or classification.

What this endpoint does

Searches Recorded Future's threat actor database, which contains over one million entries spanning nation-state groups, financially motivated actors, hacktivists, and individual underground forum or dark web members. Use the name parameter to search across canonical names, common names, and aliases — the search supports advanced prefixes including exact: for exact matches, prefix: for beginning-of-name matches, infix: for substring matches, and relevance: for relevance-sorted results. The limit parameter is required and controls page size. Omitting the name parameter returns all actors in paginated form. Use the threat actor IDs from this endpoint as filter values in Threat Actor Threat Map and Threat Actor Threat Map (Org), and consult Threat Actor Categories to understand category classifications.

Response data

Returns threat actor profiles — each representing either a group (Organization) or individual (Person) in Recorded Future's intelligence. The canonical name may differ from the name you searched for (e.g., searching "APT28" returns the actor canonically named "BlueDelta"), with the common names and aliases providing the full set of known designations across vendors, governments, and research teams. Categories classify the actor's motivation and state sponsorship (e.g., "Nation State Sponsored", "Russia Nation State Sponsored"), which is valuable for attributing incidents and understanding adversary intent. Pagination uses opaque next_offset tokens — pass the value as offset in subsequent requests. The database is very large, so always use name filters for targeted searches rather than paginating through the full dataset.

Body Params

JSON object specifying pagination of the threat actor list

name

string

This string value can be used for a case insensitive, free text search of threat actor names, common names, or aliases. For example, using name":"panda" will yield a search result with over 300 threat actors that have the word "panda" somewhere in its name, common names, or aliases. Advanced searches are supported using a prefix in the search string. For example, using "name":"exact:panda"yields only threat actor(s) whose name is just "Panda".

Prefix Match type Description no prefix freetext match (default) Returns threat actors where the search string matches somewhere in a name, a common name or an alias (case-insensitive). exact: exact match Returns threat actors where the search string exactly matches a name, a common name or an alias. prefix: prefix match Returns threat actors where the search string matches the beginning of a name, a common name or an alias. infix: infix match Returns threat actors where the search string is contained anywhere in a name, a common name or an alias. relevance: 1 word: relevance match
2+ words: relevance phrase match Returns threat actors that have text attributes relevant to the given search word or search phrase (in the same order). The results are sorted by decreasing relevance.

limit

int32

required

1 to 10000

Defaults to 10000

This integer value sets the upper limit on the number of threat actors returned.

offset

string

This string value should be received in a prior search, and is used to deliver the next set of threat actors in the search response.

Response

What this endpoint does

Response data

200OK