---
title: "Query threat actor data"
method: POST
path: "/query"
---

# Query threat actor data

`POST /query`

Submit a JSON object with one of the following fields:
- `name`: search by name or synonym (e.g., `"APT34"`, `"Sofacy"`)
- `uuid`: exact UUID search
- `country`: 2-letter country code (e.g., `"FR"`)

Returns results in MISP Galaxy format as seen in the official README.

## Request body

- union
  - object
    - `name` string, required
  - object
    - `uuid` string, required
  - object
    - `country` string, required — Two-letter ISO country code

## Response `200`

Returns an array of matching actor clusters for name/country queries,
or a single cluster for a UUID query.

- union
  - Actor[]
    - `uuid` string, uuid — Unique ID for the actor cluster
    - `value` string — Name of the actor
    - `description` string — Full textual description
    - `meta` object — Metadata including synonyms, country, refs, etc.
      - `attribution-confidence` string
      - `cfr-suspected-state-sponsor` string
      - `cfr-suspected-victims` string[]
      - `cfr-target-category` string[]
      - `cfr-type-of-incident` string
      - `country` string — Two-letter ISO country code
      - `refs` string[]
      - `synonyms` string[]
  - Actor — MISP Galaxy cluster representation of a threat actor
    - `uuid` string, uuid — Unique ID for the actor cluster
    - `value` string — Name of the actor
    - `description` string — Full textual description
    - `meta` object — Metadata including synonyms, country, refs, etc.
      - `attribution-confidence` string
      - `cfr-suspected-state-sponsor` string
      - `cfr-suspected-victims` string[]
      - `cfr-target-category` string[]
      - `cfr-type-of-incident` string
      - `country` string — Two-letter ISO country code
      - `refs` string[]
      - `synonyms` string[]

---

[API](https://skmtc.dev/misp/apis/threat-actor-intelligence-server-api.md) · [All operations](https://skmtc.dev/misp/apis/threat-actor-intelligence-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/misp/threat-actor-intelligence-server-api/revisions/c0da1532449d/schema)