Attribute Types

Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. This type of metadata provides an excellent way to organize, categorize, and capture the context around items in ThreatConnect.

Endpoint: /api/v3/attributeTypes

Available Fields

A list of valid fields for the v3/attributeTypes endpoint, which is a read-only endpoint, can be retrieved using the following query:

OPTIONS /v3/attributeTypes?show=readonly

Retrieve Attribute Types

Retrieve All Attribute Types

To retrieve all Attribute types, use the following query:

GET /v3/attributeTypes/

JSON Response:

    "data": [{
        "id": 1,
        "name": "Additional Analysis and Context",
        "description": "Relevant research and analysis associated with this Indicator, Signature, or Activity Group. Can be internal analysis or links to published articles, whitepapers, websites, or any reference providing amplifying information or geo-political context.",
        "maxSize": 65536,
        "allowMarkdown": true,
        "errorMessage": "Please enter valid Additional Analysis and Context.",
        "systemRequired": true
    }, {
        "id": 2,
        "name": "Adversary Motivation Type",
        "description": "Select an overall motivation.",
        "maxSize": 21,
        "allowMarkdown": false,
        "errorMessage": "Please enter valid Adversary Motivation Type.",
        "systemRequired": false
    "status": "Success"

Retrieve a Single Attribute Type

To retrieve a specific Attribute type, use a query in the following format:

GET /v3/attributeTypes/{attributeTypeId}

For example, the following query will return information about the Attribute type with ID 3:

GET /v3/attributeTypes/3

JSON Response:

"data": {
    "id": 3,
    "name": "Adversary Type",
    "description": "The type of Adversary.",
    "maxSize": 50,
    "allowMarkdown": false,
    "errorMessage": "Please enter valid Adversary Type: Group, Persona.",
    "systemRequired": false
"status": "Success"

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.