--- title: "Get threat details" method: GET path: "/threatmonitoring/threat" tags: ["threatmonitoring"] --- # Get threat details `GET /threatmonitoring/threat` ## Request - Base URL: `https://cyber-risk.upguard.com/api/public` - URL: `https://cyber-risk.upguard.com/api/public/threatmonitoring/threat` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Retrieve the detailed data for a specific threat, identified by UUID. Required API key permissions: `BreachRisk` (select when creating API key in Account Settings) ## Query parameters - `uuid` string, uuid, required ## Response `200` A detailed threat response - GetThreatDetailsResponsePayloadBody - `threat_details` ThreatMonitoringResultDetailed - `additional_attributes` ExternalAPIThreatAdditionalAttributes - `app_store` AppStoreExternalAPIThreatAdditionalAttributes - `advisories` string[] - `apple_id` string - `categories` string[] - `description` string - `developer` string - `downloads` string - `icon_url` string - `image_urls` string[] - `listing_url` string - `product_id` string - `rating` number, double - `rating_count` integer - `release_date` string - `store_name` string - `title` string - `updated_date` string - `chat` ChatExternalAPIThreatAdditionalAttributes - `discord` DiscordExternalAPIAddAttributes - `author` string - `channel` string - `language` string - `parsed_thread` ExternalAPIThreadEntry[] - `date` string, date-time - `text` string - `user` string - `participants` string[] - `server` string - `telegram_channel` TelegramExternalAPIAddAttributes - `author` string - `language` string - `name` string - `parsed_thread` ExternalAPIThreadEntry[] - `date` string, date-time - `text` string - `user` string - `participants` string[] - `telegram_group` TelegramExternalAPIAddAttributes - `author` string - `language` string - `name` string - `parsed_thread` ExternalAPIThreadEntry[] - `date` string, date-time - `text` string - `user` string - `participants` string[] - `cookie` CookieExternalAPIThreatAdditionalAttributes - `asn` integer - `asn_text` string - `cookie_name` string - `cookie_value` string - `device_account` string - `device_location` string - `device_name` string - `device_os` string - `device_serial_number` string - `device_user_agent` string - `ip` string - `malware_path` string - `malware_ref_url` string - `malware_type` string - `malware_version` string - `reverse_dns` string - `url` string - `data_dump` DataLeakExternalAPIThreatAdditionalAttributes - `has_password` boolean - `leak_discover_date` string, date-time - `leak_name` string - `leak_publish_date` string, date-time - `leak_size` integer - `leak_tags` DataLeakTag[] - `login` string - `masked_password` MaskedValue - `len` integer - `suffix` string - `website` string - `exposed_service_identifier` ExposedServiceIdentifierExternalAPIThreatAdditionalAttributes - `host` string - `matched_identifier` ExposedServiceAttributionIdentifierExternalAPI - `data_type` string - `data_value` string - `other_attribution_identifiers` ExposedServiceAttributionIdentifierExternalAPI[] - `data_type` string - `data_value` string - `port` integer - `service_type` string - `exposed_service_keyword` ExposedServiceKeywordExternalAPIThreatAdditionalAttributes - `attribution_identifiers` ExposedServiceAttributionIdentifierExternalAPI[] - `data_type` string - `data_value` string - `host` string - `port` integer - `record_name` string - `service_type` string - `facebook_post` FacebookPostExternalAPIThreatAdditionalAttributes - `attached_image_content` string - `attached_link` string - `attached_link_description` string - `attached_post_id` string - `comments_count` integer - `created_time` string - `fact_checks` string[] - `group_id` string - `language` string - `overlay_warning` string - `owner_full_name` string - `owner_id` string - `owner_user_name` string - `post_id` string - `post_type` string - `reactions_angry_count` integer - `reactions_haha_count` integer - `reactions_like_count` integer - `reactions_love_count` integer - `reactions_sad_count` integer - `reactions_support_count` integer - `reactions_total_count` integer - `reactions_wow_count` integer - `shares_count` integer - `text` string - `text_lang` string - `text_tagged_users` string[] - `text_tags` string[] - `timestamp` string - `facebook_profile` FacebookProfileExternalAPIThreatAdditionalAttributes - `address` string - `biography` string - `categories` string[] - `created_time` string - `current_city` string[] - `education` string[] - `email` string - `external_url` string - `followers_count` integer - `following_count` integer - `friends_count` integer - `gender` string - `hometown` string[] - `is_owned` boolean - `is_verified` boolean - `langs` string[] - `last_post_created_time` string - `likes_count` integer - `members_count` integer - `phone` string - `profile_id` string - `profile_name` string - `profile_type` string - `social_media_urls` string[] - `username` string - `workplace` string[] - `github` GithubExternalAPIThreatAdditionalAttributes - `branch` string - `commit` string - `committer_email` string - `owner` string - `repository` string - `tag` string - `target_file` string - `instagram_post` InstagramPostExternalAPIThreatAdditionalAttributes - `clickable_urls` string[] - `coauthor_producers` string[] - `comments_count` integer - `created_time` string - `is_comments_disabled` boolean - `is_video` boolean - `like_and_view_counts_disabled` boolean - `likes_count` integer - `owner_id` string - `owner_username` string - `post_id` string - `product_type` string - `related_posts` string[] - `shortcode` string - `sponsors` string[] - `text` string - `text_lang` string - `text_tagged_users` string[] - `text_tags` string[] - `timestamp` string - `video_plays_count` integer - `video_views_count` integer - `instagram_profile` InstagramProfileExternalAPIThreatAdditionalAttributes - `age_group` string - `biography` string - `business_category` string[] - `external_url` string - `followers_count` integer - `followings_count` integer - `full_name` string - `gender` string - `highlight_reels_count` integer - `is_business_account` boolean - `is_joined_recently` boolean - `is_private` boolean - `is_verified` boolean - `langs` string[] - `last_update` string - `latest_location_id` string - `posts_count` integer - `profile_id` string - `public_email` string - `public_phone_country_code` string - `public_phone_number` string - `username` string - `linkedin_company_profile` LinkedInCompanyProfileExternalAPIThreatAdditionalAttributes - `company_size` string - `company_size_on_linkedin` integer - `company_type` string - `description` string - `follower_count` integer - `founded_year` integer - `headquarters` LinkedInCompanyProfileHeadquartersExternal - `city` string - `country` string - `line1` string - `postal_code` string - `state` string - `industry` string - `last_fetched_at` string - `linkedin_internal_id` string - `linkedin_profile_url` string - `name` string - `search_id` string - `tagline` string - `universal_name_id` string - `website` string - `linkedin_user_profile` LinkedInUserProfileExternalAPIThreatAdditionalAttributes - `city` string - `connections_count` integer - `country` string - `country_full_name` string - `facebook_profile_id` string - `first_name` string - `follower_count` integer - `full_name` string - `github_profile_id` string - `headline` string - `last_fetched_at` string - `last_name` string - `linkedin_profile_url` string - `location_str` string - `occupation` string - `personal_emails` string[] - `personal_phone_numbers` string[] - `public_identifier` string - `state` string - `summary` string - `twitter_profile_id` string - `website` string - `mcp_registry` MCPRegistryExternalAPIThreatAdditionalAttributes - `packages` string[] - `published_at` string - `repository_url` string - `server_name` string - `version` string - `website_url` string - `open_web` OpenWebExternalAPIThreatAdditionalAttributes - `resource_content_length` integer - `resource_content_type` string - `resource_title` string - `password` PasswordExternalAPIThreatAdditionalAttributes - `asn` integer - `asn_text` string - `device_account` string - `device_location` string - `device_name` string - `device_os` string - `device_serial_number` string - `device_user_agent` string - `ip` string - `malware_path` string - `malware_ref_url` string - `malware_type` string - `malware_version` string - `password` string - `reverse_dns` string - `url` string - `username` string - `post` PostExternalAPIThreatAdditionalAttributes - `author` string - `language` string - `network_type` string - `post_replies` integer - `post_title` string - `site_name` string - `thread_participants` integer - `type` string - `reddit_post` RedditPostExternalAPIThreatAdditionalAttributes - `author_id` string - `author_is_blocked` boolean - `author_username` string - `comments_count` integer - `created_time` string - `is_gallery` boolean - `is_original_content` boolean - `is_video` boolean - `post_id` string - `post_url` string - `score` integer - `subreddit` string - `subreddit_id` string - `subreddit_subscribers` integer - `subreddit_type` string - `text` string - `timestamp` string - `title` string - `total_awards_received` integer - `upvote_ratio` number, double - `whitelist_status` integer - `scribd` OpenWebExternalAPIThreatAdditionalAttributes - `resource_content_length` integer - `resource_content_type` string - `resource_title` string - `stealer_logs` StealerLogsExternalAPIThreatAdditionalAttributes - `asn` integer - `asn_text` string - `autocompletes` GenericStealerLogExternalAPIThreatAdditionalAttributes[] - `name` string - `url` string - `value` string - `cookies` CookieExternalAPIThreatAdditionalAttributes[] - `asn` integer - `asn_text` string - `cookie_name` string - `cookie_value` string - `device_account` string - `device_location` string - `device_name` string - `device_os` string - `device_serial_number` string - `device_user_agent` string - `ip` string - `malware_path` string - `malware_ref_url` string - `malware_type` string - `malware_version` string - `reverse_dns` string - `url` string - `device_account` string - `device_location` string - `device_name` string - `device_os` string - `device_serial_number` string - `device_user_agent` string - `histories` GenericStealerLogExternalAPIThreatAdditionalAttributes[] - `name` string - `url` string - `value` string - `ip` string - `malware_path` string - `malware_ref_url` string - `malware_type` string - `malware_version` string - `passwords` PasswordExternalAPIThreatAdditionalAttributes[] - `asn` integer - `asn_text` string - `device_account` string - `device_location` string - `device_name` string - `device_os` string - `device_serial_number` string - `device_user_agent` string - `ip` string - `malware_path` string - `malware_ref_url` string - `malware_type` string - `malware_version` string - `password` string - `reverse_dns` string - `url` string - `username` string - `reverse_dns` string - `tiktok_profile` TiktokProfileExternalAPIThreatAdditionalAttributes - `biography_link` string - `created_time` string - `digg_count` integer - `follower_count` integer - `following_count` integer - `friend_count` integer - `full_name` string - `full_name_modify_time` string - `heart_count` integer - `is_private` boolean - `is_verified` boolean - `langs` string[] - `profile_id` string - `region` string - `signature` string - `username` string - `username_modify_time` string - `video_count` integer - `twitter_post` TwitterPostExternalAPIThreatAdditionalAttributes - `author_id` string - `author_username` string - `favorite_count` integer - `in_reply_to_post_id` string - `in_reply_to_profile_id` string - `in_reply_to_profile_username` string - `post_id` string - `post_type` string - `quote_count` integer - `reply_count` integer - `retweet_count` integer - `text` string - `text_lang` string - `text_tagged_users` string[] - `text_tags` string[] - `timestamp` integer - `view_count` integer - `twitter_profile` TwitterProfileExternalAPIThreatAdditionalAttributes - `created_time` string - `description` string - `external_url` string - `favorites_count` integer - `followers_count` integer - `friends_count` integer - `full_name` string - `is_verified` boolean - `listed_count` integer - `location` string - `media_count` integer - `profile_id` string - `statuses_count` integer - `username` string - `archived` boolean: Indicates that the threat finding has been archived through the deactivation of its transform - `auto_dismissed` boolean: Indicates whether a closed threat finding was closed automatically by the ai analyst - `closed` boolean: Indicates if the threat finding has been closed - `closed_status` string - `comments` ThreatComment[]: comments made on the threat finding - `children` ThreatComment[]: The thread of replies and additional comments leading from this one - `comment_id` integer: unique identifier for the comment - `content` string: The body (text) of the comment - `created_at` string, date-time: Time when the comment was made - `user` ThreatActor: an actor for a threat finding (multiple contexts) - `email` string: the email address of the actor - `name` string: The full name of the actor - `date_alerted` string, date-time: The date the threat was published to your feed, in RFC3339 format. If missing this field will be omitted. - `date_closed` string, date-time: The date that the threat was closed, by dismissal or remediation, in RFC3339 format. Will be omitted if the threat is still open. - `date_detected` string, date-time: The date Breach Risk discovered the threat, in RFC3339 format. If missing this field will be omitted. - `date_occurred` string, date-time: The date the original event occurred, for example a post was published or a malware infection was logged, in RFC3339 format. If missing this field will be omitted. - `date_updated` string, date-time: The date the threat was last updated, in RFC3339 format. If missing this field will be omitted. - `dismissed_at` string, date-time: The date on which the threat finding was closed in RFC3339 format. Will be omitted if threat is still open. - `dismissed_by` ThreatActor: an actor for a threat finding (multiple contexts) - `email` string: the email address of the actor - `name` string: The full name of the actor - `indicators_of_risk` string: Indicates the reason that the ai analyst applied the given severity. Omitted if not supplied. - `investigating` boolean: Indicates whether a threat finding is currently being investigated by a human analyst - `investigator` ThreatActor: an actor for a threat finding (multiple contexts) - `email` string: the email address of the actor - `name` string: The full name of the actor - `labels` ThreatLabel[]: labels applied to the threat finding - `name` string - `module` string: MonitoredThreatModule Is used to indicate the threat monitoring module for which the data has been collected - `number_of_comments` integer: The number of comments attached to the threat finding - `recommended_remediation` string: Remediation guidance provided by the ai analyst for this threat finding. Omitted if not supplied. - `remediated_at` string, date-time: The date on which the threat finding was remediated in RFC3339 format. Will be omitted if not applicable. - `remediated_by` ThreatActor: an actor for a threat finding (multiple contexts) - `email` string: the email address of the actor - `name` string: The full name of the actor - `remediation_outcome` string - `remediation_outcome_notes` string: Notes made by the remediator. Will be omitted if not applicable or empty. - `remediation_request_last_updated_at` string, date-time: The date on which the remediation request for this threat finding was last updated in RFC3339 format. Will be omitted if not applicable. - `remediation_risk_details` string: Details of the threat remediation as supplied by the ai analyst for this threat finding. Omitted if not supplied. - `remediation_risk_summary` string: Summary of the threat remediation as supplied by the ai analyst for this threat finding. Omitted if not supplied. - `severity` string: The severity of the threat - `snippet` string: The text snippet associated with the threat finding. If not applicable, this field will be omitted. - `source` string: MonitoredThreatSourceType Is used to indicate the type of source from which our data vendor discovered the dark web data. This is used to partially categorize the result and is derived from the content of the result itself. @see ThreatMonitoringRawResult.DetermineDerivedMeta() - `source_domain` string: The source domain (eg facebook.com) for the threat. If unknown, this field will be omitted. - `source_site` string: A common name source domain (eg facebook.com) for the threat. If unknown, this field will be omitted. - `threat_context` string: Context of the threat conditions as given by the ai analyst for this threat finding. Omitted if not supplied. - `threat_status` string: The current status of the threat - `threat_types` MonitoredThreatType[]: One or more threat types associated with the threat finding - `title` string: The title of the threat finding - `transforms` string[]: The list of matching transforms that identified this threat finding - `url` string: The URL associated with the threat finding. If unknown or not applicable, this field will be omitted. - `uuid` string, uuid: The unique identifier for the finding ## Other responses - `404`: There was a problem with the request - `422`: An invalid parameter was supplied or a mandatory parameter was missing - `429`: Too many requests have been made to this endpoint. - `500`: An internal system error occurred ## Changes - **2026-11-07** `d044bf6dc61e`: 1 info - endpoint added [Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/threatmonitoring/threat/get.md) --- [API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)