---
title: "List Threat Intel Indicator"
method: POST
path: "/threat-intel-indicators/get-list"
tags: ["Threat Intel Indicator"]
---

# List Threat Intel Indicator

`POST /threat-intel-indicators/get-list`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/threat-intel-indicators/get-list`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/threat-intel-indicators/get-list/post.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to list all Threat Intel Indicator items

## Request body

- object
  - `query` ThreatIntelIndicatorItemV1QuerySchema: Query schema for ThreatIntelIndicatorItemV1. A field takes a plain value, which it matches exactly, or an operator its type allows. Telemetry tables are large: bound every query by validFrom.
    - `projectId` union: Query operators for projectId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `feedId` union: Query operators for feedId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `feedName` union: Query operators for feedName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `stixId` union: Query operators for stixId field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `indicatorType` union: Query operators for indicatorType field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `indicatorValue` union: Query operators for indicatorValue field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `indicatorName` union: Query operators for indicatorName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `confidence` union: Query operators for confidence field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween.
      - number
      - object
        - `_type` 'NotEqual', required
        - `value` number, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` number, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'LessThan', required
        - `value` number, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'InBetween', required
        - `startValue` number, required
        - `endValue` number, required
    - `stixLabels` union: Query operators for stixLabels field of type Array of Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, Search. EqualTo, NotEqual and Search match one element; Includes matches any of several.
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
      - object
        - `_type` 'Search', required
        - `value` string, required
    - `validFrom` union: Query operators for validFrom field of type DateTime64. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `validUntil` union: Query operators for validUntil field of type DateTime64. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `revoked` union: Query operators for revoked field of type Boolean. Supported operators: EqualTo, NotEqual, IsNull, NotNull.
      - boolean
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
    - `version` union: Query operators for version field of type UInt64. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. A value past 2^53 is sent as a string of digits.
      - number
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` union, required
          - number
          - string
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` union, required
          - number
          - string
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` union, required
          - number
          - string
      - object
        - `_type` 'LessThan', required
        - `value` union, required
          - number
          - string
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` union, required
          - number
          - string
      - object
        - `_type` 'InBetween', required
        - `startValue` union, required
          - number
          - string
        - `endValue` union, required
          - number
          - string
    - `retentionDate` union: Query operators for retentionDate field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `_id` union: Query operators for _id field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes.
      - string
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `createdAt` union: Query operators for createdAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
  - `select` ThreatIntelIndicatorItemV1SelectSchema: Select schema for ThreatIntelIndicatorItemV1. Set fields to true to include them in the response.
    - `projectId` boolean
    - `feedId` boolean
    - `feedName` boolean
    - `stixId` boolean
    - `indicatorType` boolean
    - `indicatorValue` boolean
    - `indicatorName` boolean
    - `confidence` boolean
    - `stixLabels` boolean
    - `validFrom` boolean
    - `validUntil` boolean
    - `revoked` boolean
    - `version` boolean
    - `retentionDate` boolean
    - `_id` boolean
    - `createdAt` boolean
  - `sort` ThreatIntelIndicatorItemV1SortSchema: Sort schema for ThreatIntelIndicatorItemV1. Only sortable fields are included.
    - `projectId` 'ASC' | 'DESC': Sort order for projectId field
    - `feedId` 'ASC' | 'DESC': Sort order for feedId field
    - `feedName` 'ASC' | 'DESC': Sort order for feedName field
    - `stixId` 'ASC' | 'DESC': Sort order for stixId field
    - `indicatorType` 'ASC' | 'DESC': Sort order for indicatorType field
    - `indicatorValue` 'ASC' | 'DESC': Sort order for indicatorValue field
    - `indicatorName` 'ASC' | 'DESC': Sort order for indicatorName field
    - `confidence` 'ASC' | 'DESC': Sort order for confidence field
    - `validFrom` 'ASC' | 'DESC': Sort order for validFrom field
    - `validUntil` 'ASC' | 'DESC': Sort order for validUntil field
    - `revoked` 'ASC' | 'DESC': Sort order for revoked field
    - `version` 'ASC' | 'DESC': Sort order for version field
    - `retentionDate` 'ASC' | 'DESC': Sort order for retentionDate field
    - `_id` 'ASC' | 'DESC': Sort order for _id field
    - `createdAt` 'ASC' | 'DESC': Sort order for createdAt field
  - `groupBy` ThreatIntelIndicatorItemV1GroupBySchema: Group by schema for ThreatIntelIndicatorItemV1. Only one field can be set to true for grouping.
    - `projectId` boolean: Group by projectId field. Only one field can be selected for grouping.
    - `feedId` boolean: Group by feedId field. Only one field can be selected for grouping.
    - `feedName` boolean: Group by feedName field. Only one field can be selected for grouping.
    - `stixId` boolean: Group by stixId field. Only one field can be selected for grouping.
    - `indicatorType` boolean: Group by indicatorType field. Only one field can be selected for grouping.
    - `indicatorValue` boolean: Group by indicatorValue field. Only one field can be selected for grouping.
    - `indicatorName` boolean: Group by indicatorName field. Only one field can be selected for grouping.
    - `confidence` boolean: Group by confidence field. Only one field can be selected for grouping.
    - `revoked` boolean: Group by revoked field. Only one field can be selected for grouping.
    - `retentionDate` boolean: Group by retentionDate field. Only one field can be selected for grouping.
    - `_id` boolean: Group by _id field. Only one field can be selected for grouping.
    - `createdAt` boolean: Group by createdAt field. Only one field can be selected for grouping.
  - `limit` number: Maximum number of items to return. Defaults to 10.
  - `skip` number: Number of items to skip for pagination. Defaults to 0.

## Response `200`

Successful response

- object
  - `data` ThreatIntelIndicatorItemV1[]
    - `projectId` string, required: Project ID
    - `feedId` string, required: Feed ID
    - `feedName` string: Feed
    - `stixId` string: STIX ID
    - `indicatorType` string: Indicator Type
    - `indicatorValue` string: Indicator Value
    - `indicatorName` string: Name
    - `confidence` number: Confidence
    - `stixLabels` string[]: Labels
    - `validFrom` string: Valid From
    - `validUntil` string: Valid Until
    - `revoked` boolean: Revoked
    - `version` string: Version
    - `retentionDate` string, date-time, required: Retention Date
  - `count` number

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)