get https://www.virustotal.com/api/v3/threat_actors//
The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:
| Relationship | Supported orders | Default order |
|---|---|---|
| collections | creation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques | - |
| comments | - | date- |
| references | - | - |
| related_domains | creation_date, last_modification_date, last_update_date, positives | last_modification_date- |
| related_files | first_submission_date, last_submission_date, positives, times_submitted, size | last_submission_date- |
| related_ip_addresses | ip, last_modification_date, positives | last_modification_date- |
| related_references | - | - |
| related_urls | first_submission_date, last_submission_date, positives, times_submitted, status | last_submission_date- |
⚠️ Threat actors endpoints are only available to users with the vtinsights privilege.
Available relationships are described in the Threat Actor object documentation.