---
title: "Get Profile Indicators"
method: POST
path: "/v1/prevention/profiles/{id}/indicators"
tags: ["Threat Prevention"]
---

# Get Profile Indicators

`POST /v1/prevention/profiles/{id}/indicators`

Fetch the block list of confirmed-malicious indicators from a prevention profile.

## Path parameters

- `id` string, uuid, required — Identity of an automation profile

## Request body

- object
  - `filter` object
    - `types` string[] — Decides what observable types are included in the results
    - `algorithms` HashAlgorithm[] — Decides what hash algorithms are included in the results
  - `include` object
    - `risk` object
      - `score` boolean — Decides if risk score is included in the results
      - `rules` boolean — Decides if risk rules are included in the results
  - `limit` integer
  - `offset` string

## Response `200`

Indicators for this profile

- object
  - `count` integer, required — Number of indicators matching the filter
  - `totalCount` integer, required — Total number of indicators matching the filter
  - `nextOffset` string — Offset to use for getting the next batch of data when paging
  - `items` Indicator[], required — A batch of indicators matching the filter
    - `description` string, nullable — A descriptive message detailing the indicator.
    - `ioc` string, nullable
    - `procid` integer — Process identifier associated with this indicator.

## Other responses

- `404` — Profile not found

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)