Threat Actor Detail

GEThttps://api.deepinfo.com/v1/cti/threat-actors/{threat_actor_id}

Returns one threat actor profile.

Request

curl

curl 'https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff"

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/cti/threat-actors/ffffffffffffffffffffffff')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

404 Not Found · application/json

Response Body

{
  "code": 30003,
  "details": [
    "Threat Actor with given id=ffffffffffffffffffffffff does not exist."
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Authentication

Send your API key in the apikey request header.

Path Parameters

Parameter	Required	Description
`threat_actor_id`	Required	Example`<threat_actor_id>`

Response Fields

Field	Type	Description
`id`	string
`name`	string
`aliases`	array of string
`date_updated`	string	date-time
`date_first_seen`	string	date-time
`date_last_seen`	string	date-time
`is_active`	boolean
`actor_size`	string
`actor_types`	array of string
`actor_sophistication`	string
`actor_specializations`	array of string
`description`	string
`law_enforcement`	string
`contact_info`	object
`social_media`	object
`websites`	array of string
`payment_info`	object
`origin_countries`	array of string
`leak_names`	array of string
`forum_names`	array of string
`market_names`	array of string
`forum_market_usernames`	array of string
`targeted_regions`	array of string
`targeted_countries`	array of string
`targeted_industries`	array of string
`targeted_organizations`	array of string
`cves_used`	array of string
`tools_used`	array of string

No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

Examples

The request and response panels show this example.

Not Found (nonexistent threat_actor_id)GET/cti/threat-actors/ffffffffffffffffffffffff404 Not Found

Reference updated September 27, 2026