---
title: "Query Profiles"
method: POST
path: "/v1/detection/profiles/query"
tags: ["Threat Detection"]
---

# Query Profiles

`POST /v1/detection/profiles/query`

## Request

- Base URL: `https://api.recordedfuture.com/autonomous-threat-operations`
- URL: `https://api.recordedfuture.com/autonomous-threat-operations/v1/detection/profiles/query`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Discover threat detection profiles with continuously-updated indicators and detection rules.

## Request body

- object: Query parameters for filtering automation profiles. At least one of `ids` (non-empty array) or `enterprise` must be provided. An empty body or empty `ids` array will return a 400 error.
  - `ids` ProfileId[]: Profile IDs to filter by. Must be a non-empty array if provided. Required if enterprise is not specified.
  - `enterprise` string
  - `integration` string

## Response `200`

List of threat detection profiles matching the query

- object
  - `items` object[], required
    - `id` string, uuid, required: Identity of an automation profile
    - `name` string, required: Name of the profile
    - `description` string: Description of the profile
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: Too many profiles requested

---

[API](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/revisions/a984b61a0cf8?raw)