Indicators

Update Indicator by ID

Changed on Nov 3, 2026

Allows the updating of an existing Indicator

put/v3/indicators/{uniqueId}

Request

Base URL
https://app.threatconnect.com/api
URL
https://app.threatconnect.com/api/v3/indicators/{uniqueId}
Auth
API key in header Authorization

Path parameters

uniqueId'1' | '2' | '3' required

param ID of the Indicator that needs to be updated

ID of the Indicator to be updated

Query parameters

fieldsstring[]

Indicator subentity fields to include in response (See OPTIONS endpoint for valid values)

createActivityLogstring

Boolean to signal whether or not to create an alert for this action

Request body

idinteger

dateAddedstring date-time

ownerIdinteger

ownerNamestring

webLinkstring

typestring required

lastModifiedstring date-time

externalDateAddedstring date-time

externalLastModifiedstring date-time

externalDateExpiresstring date-time

firstSeenstring date-time

lastSeenstring date-time

ratingnumber

confidenceinteger

threatAssessRatingnumber double

threatAssessConfidencenumber double

threatAssessScoreinteger

threatAssessScoreObservedinteger

threatAssessScoreFalsePositiveinteger

calScoreinteger

calLastCheckedstring date-time

sourcestring

descriptionstring

summarystring

observationsinteger

lastObservedstring date-time

falsePositivesinteger

lastFalsePositivestring date-time

falsePositiveReportedByUserboolean

falsePositiveFlagboolean

trackedUsersobject

privateFlagboolean

activeboolean

activeLockedboolean

value1string

value2string

value3string

flag1boolean

flag2boolean

flag3boolean

intValue1integer

intValue2integer

intValue3integer

addressstring

md5string

sha1string

sha256string

sizeinteger

modestring

ipstring

hostNamestring

dnsActiveboolean

whoisActiveboolean

textstring

legacyLinkstring

Response

The updated Indicator