---
title: "List all findings of the threat actor."
method: GET
path: "/api/v2/riskintelligence/threat-actors/{threatActorId}/findings"
tags: ["Risk Intelligence"]
---

# List all findings of the threat actor.

`GET /api/v2/riskintelligence/threat-actors/{threatActorId}/findings`

## Request

- Base URL: `https://app.blackkitetech.com`
- URL: `https://app.blackkitetech.com/api/v2/riskintelligence/threat-actors/{threatActorId}/findings`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.blackkitetech.com//api/v2/oauth/token`
- TypeScript: <https://skmtc.dev/blackkitetech/apis/black-kite-api/docs/api/v2/riskintelligence/threat-actors/:threatActorId/findings/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `threatActorId` integer, required

## Query parameters

- `companyId` integer, required
- `page_number` integer
- `page_size` 10 | 20 | 30 | 50 | 100 | 250 | 500 | 1000

## Response `200`

Success

- Finding[]
  - `Module` string: The module of this finding. The possible responses are listed below. - DNS Health - Email Security - SSL/TLS Strength - Application Security - DDoS Resiliency - Network Security - Fraudulent Domains - Fraudulent Apps - Credential Mgmt. - IP Reputation - Hacktivist Shares - Social Network - Attack Surface - Brand Monitoring - Patch Management - Web Ranking - Information Disclosure - CDN Security - Website Security
  - `FindingId` integer: The unique identifier of this finding.
  - `Status` 'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated': The status of this finding. - Active, means the finding is still active with no review as of yet. - FalsePositive, means the finding is considered to be false alarm. - Suppressed, means the finding is suppressed, similar to FalsePositive. - Acknowledged, means the finding is accepted, for example will not be fixed. - Deleted, means the finding is deleted, similar to FalsePositive. - Remediated, means the finding is mitigated.
  - `FirstSeenDate` string, date-time: The date that the finding was found.
  - `UpdateDate` string, date-time: The last date that the finding was updated. If the UpdateDate equals to the FirstSeenDate or the UpdateDate is null that means the finding is NEW, otherwise the finding is UPDATED.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `default`: Failure

---

[API](https://skmtc.dev/blackkitetech/apis/black-kite-api.md) - [All operations](https://skmtc.dev/blackkitetech/apis/black-kite-api/llms.txt) - [OpenAPI document](https://skmtc.dev/blackkitetech/apis/black-kite-api/revisions/0950b35c0e4a?raw)