API Reference

List Atomic Tests

Return a paged list of Atomic Red Team atomic tests, optionally filtered by ATT&CK technique ID and platform. Useful for enumerating available test coverage before retrieving full test details.

GET

/v1/atomics/tests

Cost: 1 credit per successful call

Query parameters

technique_idstringoptional

ATT&CK technique ID to filter by. Pattern: ^T\d{4}(\.\d{3})?$. Examples: T1059, T1059.001.

platformstringoptional

Platform slug to filter by. Maximum 40 characters, pattern ^[A-Za-z0-9_-]+$. Examples: windows, linux, macos.

limitintegeroptionaldefault: 50

Number of results to return. Accepted range: 1–100.

offsetintegeroptionaldefault: 0

Row offset for pagination. Accepted range: 0–2000. Increment by limit to step through large result sets.

Request

curl "https://api.precursorintelligence.com/functions/v1/atomics/tests?technique_id=T1059.001&platform=windows&limit=25&offset=0" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 2,
    "total": 14,
    "technique_id": "T1059.001",
    "platform": "windows",
    "limit": 25,
    "offset": 0,
    "items": [
      {
        "id": 4012,
        "name": "PowerShell -Enc",
        "description": "Executes an encoded PowerShell command to evade simple string-based detection.",
        "auto_generated_guid": "a3b2c1d0-1234-5678-abcd-ef0123456789",
        "supported_platforms": ["windows"],
        "attack_technique": "T1059.001",
        "display_name": "PowerShell"
      },
      {
        "id": 4013,
        "name": "PowerShell Download Cradle",
        "description": "Downloads and executes a remote script using a PowerShell download cradle.",
        "auto_generated_guid": "b4c3d2e1-2345-6789-bcde-f01234567890",
        "supported_platforms": ["windows"],
        "attack_technique": "T1059.001",
        "display_name": "PowerShell"
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of items returned (equals items.length).

data.totalintegeroptional

Total number of tests matching the filter, across all pages.

data.technique_idstring | nulloptional

The ATT&CK technique ID filter that was applied, or null if none.

data.platformstring | nulloptional

The platform slug filter that was applied, or null if none.

data.limitintegeroptional

The maximum number of results requested.

data.offsetintegeroptional

The row offset applied for pagination.

data.itemsarrayoptional

Matched atomic tests. Each object contains the fields below.

data.items[].idintegeroptional

Internal id of the atomic test. Pass this to GET /v1/atomics/tests/{atomic-test-id} for full details.

data.items[].namestringoptional

Human-readable name of the atomic test.

data.items[].descriptionstringoptional

What the test does and what adversary behavior it simulates.

data.items[].auto_generated_guidstringoptional

Stable globally unique identifier assigned by the Atomic Red Team project.

data.items[].supported_platformsarrayoptional

Platforms the test runs on (e.g. windows, linux, macos).

data.items[].attack_techniquestringoptional

ATT&CK technique or sub-technique ID the test maps to.

data.items[].display_namestringoptional

Human-readable name of the mapped ATT&CK technique.

data.generated_atstringoptional

ISO 8601 timestamp when the response was generated.

Errors

Status	`error`	When
400	`invalid_technique_id`, `invalid_platform`, `invalid_limit`, `invalid_offset`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.