Actors

Named threat groups with confirmed attribution — nation-state, cybercrime, hacktivist, or PSOA.

List all actors

GET/actors

Returns all actors, newest first. Each entry includes aliases as an array of names.

Parameter	Type		Description
country	string	opt	ISO 3166-1 alpha-2 country code (e.g. IR)
type	string	opt	Actor type (see type below)

Get an actor

GET/actors/:id

Returns a single actor with full detail: aliases, edges, and associated reports. Accepts either UUID or slug.

Actor timeline

GET/actors/:id/timeline

Returns the actor's timeline events as an array (empty if none). Accepts UUID or slug.

Actor object

Field	Type	Description
id	uuid	Unique identifier
name	string	Primary display name (resolved from aliases)
slug	string	URL-friendly name (e.g. muddywater)
type	string	nation-state / cybercrime / hacktivist / psoa / unclassified / unknown
country_code	string	ISO 3166-1 alpha-2 country code of attributed origin
region	string	Geographic region (e.g. Middle East)
motivation	string[]	espionage / financial / disruption / hacktivism
attribution_note	string	Human-readable attribution statement from the source
first_seen	string	Year the actor was first observed or disclosed, as extracted from its source reports (ISO date, year precision, e.g. 2019-01-01). When reports give different years, the earliest is kept. null when no year is recorded. The actor page shows this as Active Since, and shows "Unknown" when it is null. It is never derived from campaign dates.
bio	string	Full attribution write-up
aliases	object[]	Array of { name, is_primary } (in the list endpoint, an array of names)
edges	object[]	Typed relationships — each carries confidence_label (Confirmed / High confidence / Assessed / Suspected / Possible); the raw confidence score is never exposed
reports	object[]	Source reports that document this actor
inherited_activity	object	TTPs, tools, and CVEs inherited from campaigns attributed to the actor, from clusters attributed to the actor, and from those clusters' campaigns
ttp_tactics	string[]	MITRE ATT&CK tactics of the actor's TTPs, most frequent first
target_sectors	string[]	Targeted sectors
target_countries	string[]	Targeted countries
last_seen	string	Latest known activity, when known
created_at	string	ISO 8601 timestamp
updated_at	string	ISO 8601 timestamp