---
title: "Get Threat Intel Indicator"
method: POST
path: "/threat-intel-indicators/{id}/get-item"
tags: ["Threat Intel Indicator"]
---

# Get Threat Intel Indicator

`POST /threat-intel-indicators/{id}/get-item`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/threat-intel-indicators/{id}/get-item`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/threat-intel-indicators/:id/get-item/post.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to retrieve a single Threat Intel Indicator by ID

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `select` ThreatIntelIndicatorItemV1SelectSchema: Select schema for ThreatIntelIndicatorItemV1. Set fields to true to include them in the response.
    - `projectId` boolean
    - `feedId` boolean
    - `feedName` boolean
    - `stixId` boolean
    - `indicatorType` boolean
    - `indicatorValue` boolean
    - `indicatorName` boolean
    - `confidence` boolean
    - `stixLabels` boolean
    - `validFrom` boolean
    - `validUntil` boolean
    - `revoked` boolean
    - `version` boolean
    - `retentionDate` boolean
    - `_id` boolean
    - `createdAt` boolean

## Response `200`

Successful response

- object
  - `data` ThreatIntelIndicatorItemV1
    - `projectId` string, required: Project ID
    - `feedId` string, required: Feed ID
    - `feedName` string: Feed
    - `stixId` string: STIX ID
    - `indicatorType` string: Indicator Type
    - `indicatorValue` string: Indicator Value
    - `indicatorName` string: Name
    - `confidence` number: Confidence
    - `stixLabels` string[]: Labels
    - `validFrom` string: Valid From
    - `validUntil` string: Valid Until
    - `revoked` boolean: Revoked
    - `version` string: Version
    - `retentionDate` string, date-time, required: Retention Date

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)