---
title: "Get Profile Indicators"
method: POST
path: "/v1/detection/profiles/{id}/indicators"
tags: ["Threat Detection"]
---

# Get Profile Indicators

`POST /v1/detection/profiles/{id}/indicators`

## Request

- Base URL: `https://api.recordedfuture.com/autonomous-threat-operations`
- URL: `https://api.recordedfuture.com/autonomous-threat-operations/v1/detection/profiles/{id}/indicators`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Fetch continuously-updated threat indicators from a detection profile with optional risk score enrichment.

## Path parameters

- `id` string, uuid, required: Identity of an automation profile

## Request body

- object
  - `filter` object
    - `types` string[]: Decides what observable types are included in the results
    - `algorithms` HashAlgorithm[]: Decides what hash algorithms are included in the results
  - `include` object
    - `risk` object
      - `score` boolean: Decides if risk score is included in the results
      - `rules` boolean: Decides if risk rules are included in the results
  - `limit` integer
  - `offset` string

## Response `200`

Indicators for this profile

- object
  - `count` integer, required: Number of indicators matching the filter
  - `totalCount` integer, required: Total number of indicators matching the filter
  - `nextOffset` string: Offset to use for getting the next batch of data when paging
  - `items` Indicator[], required: A batch of indicators matching the filter
    - `type` 'domain' | 'hash' | 'ip' | 'url', required
    - `observable` string, required
    - `algorithm` 'MD5' | 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512'
    - `risk` object
      - `score` integer
      - `rules` object[]
        - `id` string, uuid, required: Unique risk rule id
        - `level` integer, required: Risk level of this risk rule
        - `sightings` integer: Number of sightings causing this risk rule to trigger
        - `description` string
        - `timestamp` string, date-time: Date and time that the risk rule triggered
    - `ttp` object[]
      - `code` string
      - `name` string

## Other responses

- `404`: Profile not found

---

[API](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/revisions/a984b61a0cf8?raw)