---
title: "Get a Threat's observed actions list"
method: GET
path: "/collections/{id}/timeline/events"
tags: ["Threat Actors, Malware & Tools, Campaigns, IoC Collections"]
---

# Get a Threat's observed actions list

`GET /collections/{id}/timeline/events`

## Request

- Base URL: `https://www.virustotal.com/api/v3`
- URL: `https://www.virustotal.com/api/v3/collections/{id}/timeline/events`
- Auth: none required
- TypeScript: <https://skmtc.dev/virustotal/apis/threat-landscape/docs/collections/:id/timeline/events/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `id` string, required

## Headers

- `x-apikey` string, required

## Response `200`

200

- object

## Other responses

- `400`: 400

---

[API](https://skmtc.dev/virustotal/apis/threat-landscape.md) - [All operations](https://skmtc.dev/virustotal/apis/threat-landscape/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/threat-landscape/revisions/a15abb3e8389?raw)