API Reference

List ATT&CK Groups

Return MITRE ATT&CK groups (intrusion sets), optionally filtered by a free-text query that matches the group name, ATT&CK ID, or any known alias. Results are sorted by name and capped by limit.

GET

/v1/mitre/groups

Cost: 1 credit per successful call

Query parameters

qstringoptionaldefault: (no filter)

Free-text search term. Matches the group name, the G#### ATT&CK ID, or any alias (case-insensitive substring). Length 1–80 characters. Omit to return all groups up to limit.

limitintegeroptionaldefault: 50

Maximum number of groups to return. Accepted range: 1–200.

Request

curl "https://api.precursorintelligence.com/functions/v1/mitre/groups?q=cozy&limit=50" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 2,
    "items": [
      {
        "attack_id": "G0016",
        "name": "APT29",
        "aliases": ["APT29", "IRON RITUAL", "NOBELIUM", "Cozy Bear", "Midnight Blizzard"],
        "description": "APT29 is a threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).",
        "url": "https://attack.mitre.org/groups/G0016"
      },
      {
        "attack_id": "G0050",
        "name": "APT32",
        "aliases": ["APT32", "SeaLotus", "OceanLotus", "APT-C-00", "Canvas Cyclone", "BISMUTH"],
        "description": "APT32 is a suspected Vietnam-based threat group that has been active since at least 2014.",
        "url": "https://attack.mitre.org/groups/G0050"
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of groups returned (equals items.length).

data.itemsarrayoptional

Groups matching the query, sorted by name. Each object contains the fields below.

data.items[].attack_idstringoptional

The canonical ATT&CK group identifier (e.g. G0016).

data.items[].namestringoptional

The primary group name (e.g. APT29).

data.items[].aliasesarrayoptional

Known aliases for the group (e.g. ["Cozy Bear", "NOBELIUM"]). May be empty.

data.items[].descriptionstringoptional

The group's ATT&CK description, as published by MITRE.

data.items[].urlstringoptional

The canonical MITRE ATT&CK URL for the group.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_q`	`q` is empty after trimming or exceeds 80 characters.
400	`invalid_limit`	`limit` is not an integer in the range 1–200.
401	`invalid_authorization`	The `Authorization` header is missing or malformed.
401	`unauthorized`	The key is invalid, revoked, or the request IP is not on the allowlist.
402	`insufficient_credits`	The organisation's credit balance is below 1.
404	`not_found`	The route does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference.