--- title: ThreatQuotient ThreatQ slug: connectors/threatquotient-threatq docTags: createdAt: 2026-06-09T16:30:04.135Z --- The ThreatQuotient ThreatQ connector facilitates the automation of threat intelligence operations by enabling seamless integration with the ThreatQ platform. ThreatQuotient ThreatQ is a threat intelligence platform that aggregates, correlates, and analyzes threat data to provide actionable insights. This connector enables Swimlane Turbine users to automate the ingestion and management of threat intelligence, streamline event and indicator handling, and enhance security operations with enriched data. By integrating with ThreatQuotient ThreatQ, users can create and manage events, indicators, and import sessions, as well as perform detailed searches and updates, all within the Swimlane Turbine environment. ## Prerequisites Before integrating ThreatQuotient ThreatQ with Swimlane Turbine, ensure you have the following: - OAuth 2.0 authentication credentials with the following parameters: - URL: The endpoint URL for ThreatQ API access - API User Email: The email associated with your ThreatQ account - Client Password: Your password for OAuth client authentication - OAuth Client ID: The client ID provided by ThreatQ for OAuth setup - API Type: The specific API type or version supported by ThreatQ ## Capabilities The ThreatQuotient Connector has the following capabilities: - Create Event - Create Indicators List - Delete Import Indicator - Get Event List - Get Indicators List - Get Indicator by ID - Import Events - Indicator Search - Indicator Search with Value - Indicators Query - Update Import Indicator ## Additional Documentation - [ThreatQuotient ThreatQ Connector Documentation](https://docs.swimlane.com/connectors/threatquotient-threatq) - [ThreatQuotient ThreatQ API Documentation](https://docs.threatq.com/) - [ThreatQuotient ThreatQ Authentication Guide](https://docs.swimlane.com/authentication-guides/threatquotient-threatq) # Configurations ## Oauth Password Grant Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | email | The username for authentication | string | Required | | password | The password for authentication | string | Required | | clientId | Client ID of ThreatQ OAuth | string | Required | | api\_type | Authentication is different for standard and beta versions of Threatq API | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create Event Initiates the creation of a new event in ThreatQuotient ThreatQ using provided JSON body data. ### Endpoint - **URL:** `api/events` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------- | | `title` | string | Optional | Parameter for Create Event | | `type` | string | Optional | Type of the resource | | `happened_at` | string | Optional | Parameter for Create Event | | `sources` | array | Optional | Parameter for Create Event | | `sources.name` | string | Optional | Name of the resource | | `sources.tlp` | object | Optional | Parameter for Create Event | | `sources.tlp.name` | string | Optional | Name of the resource | ### Input Example `{"json_body":{"title":"Event Name","type":"Spearphish","happened_at":"2017-03-20 01:43:05","sources":[{"name":"Event Source","tlp":{"name":"AMBER"}}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.title` | string | Response data | | `data.type_id` | number | Response data | | `data.happened_at` | string | Response data | | `data.hash` | string | Response data | | `data.updated_at` | string | Response data | | `data.created_at` | string | Response data | | `data.id` | number | Response data | | `data.type` | object | Response data | | `data.type.id` | number | Response data | | `data.type.name` | string | Response data | | `data.type.user_editable` | string | Response data | | `data.type.created_at` | string | Response data | | `data.type.updated_at` | string | Response data | | `data.sources` | array | Response data | | `data.sources.type` | string | Response data | | `data.sources.name` | string | Response data | | `data.sources.updated_at` | string | Response data | | `data.sources.created_at` | string | Response data | | `data.sources.id` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"title":"Event Name","type_id":1,"happened_at":"2017-03-20 01:43:05","hash":"e59c3274f3156b10aca1c8962a5880cb","updated_at":"2017-03-20 13:35:13","created_at":"2017-03-20 13:35:13","id":601,"type":{},"sources":[]}}}` ## Create Indicators List Generates a new list of indicators in ThreatQuotient ThreatQ based on the provided JSON body. ### Endpoint - **URL:** `api/indicators` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.limit` | number | Optional | Parameters for the Create Indicators List action | | `parameters.offset` | number | Optional | Parameters for the Create Indicators List action | | `parameters.sort` | string | Optional | Parameters for the Create Indicators List action | | `parameters.with` | string | Optional | Parameters for the Create Indicators List action | ### Input Example `{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"},"json_body":[{"class":"network","value":"115.47.67.155","type_id":"10","status_id":2,"sources":[{"name":"Source","tlp":{"name":"GREEN"},"published_at":"2016-07-18 02:00:00"}],"attributes":[{"name":"Confidence","value":"High","sources":[{"name":"Source","tlp":{"name":"GREEN"},"published_at":"2016-07-18 02:00:00"}]},{"name":"Port","value":"4000"},{"name":"Scheme","value":"https"}]}]}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.class` | string | Response data | | `data.hash` | string | Response data | | `data.value` | string | Response data | | `data.last_detected_at` | object | Response data | | `data.expires_at` | object | Response data | | `data.expired_at` | object | Response data | | `data.expires_calculated_at` | object | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | | `data.existing` | string | Response data | | `data.type` | object | Response data | | `data.type.id` | number | Response data | | `data.type.name` | string | Response data | | `data.type.class` | string | Response data | | `data.type.score` | object | Response data | | `data.type.wildcard_matching` | string | Response data | | `data.type.created_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":1,"data":[{}]}}` ## Delete Import Indicator Removes a specific indicator from an import session in ThreatQuotient ThreatQ using the import ID and indicator ID. ### Endpoint - **URL:** `api/imports/{{import_id}}/indicators/{{import_indicator_id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.import_id` | number | Required | Parameters for the Delete Import Indicator action | | `path_parameters.import_indicator_id` | number | Required | Parameters for the Delete Import Indicator action | ### Input Example `{"path_parameters":{"import_id":1,"import_indicator_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{},"reason":"OK"}` ## Get Event List Retrieve a list of security events from ThreatQuotient ThreatQ with options for filtering and sorting. ### Endpoint - **URL:** `api/events` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Get Event List action | | `parameters.offset` | number | Optional | Parameters for the Get Event List action | | `parameters.sort` | string | Optional | Parameters for the Get Event List action | | `parameters.with` | string | Optional | Parameters for the Get Event List action | ### Input Example `{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.type_id` | number | Response data | | `data.title` | string | Response data | | `data.description` | string | Response data | | `data.happened_at` | string | Response data | | `data.hash` | string | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":600,"data":[{},{},{}]}}` ## Get Indicator by ID Retrieve a specific indicator from ThreatQuotient ThreatQ using the unique identifier provided. ### Endpoint - **URL:** `api/indicators/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Indicator by ID action | | `parameters.with` | string | Optional | Parameters for the Get Indicator by ID action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"with":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.class` | string | Response data | | `data.hash` | string | Response data | | `data.value` | string | Response data | | `data.last_detected_at` | string | Response data | | `data.expires_at` | object | Response data | | `data.expired_at` | object | Response data | | `data.expires_calculated_at` | object | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 31 Aug 2023 07:33:24 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Server":"Apache","X-Frame-Options":"SAMEORIGIN","Vary":"Authorization","Cache-Control":"no-cache","Content-Security-Policy":"frame-ancestors 'self';","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Set-Cookie":"threatq_api=eyJpdiI6Il...` ## Get Indicators List Retrieve a comprehensive list of indicators from ThreatQuotient ThreatQ for analysis and threat intelligence. ### Endpoint - **URL:** `api/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Get Indicators List action | | `parameters.offset` | number | Optional | Parameters for the Get Indicators List action | | `parameters.sort` | string | Optional | Parameters for the Get Indicators List action | | `parameters.with` | string | Optional | Parameters for the Get Indicators List action | ### Input Example `{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.class` | string | Response data | | `data.hash` | string | Response data | | `data.value` | string | Response data | | `data.last_detected_at` | string | Response data | | `data.expires_at` | object | Response data | | `data.expired_at` | object | Response data | | `data.expires_calculated_at` | object | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":7481,"data":[{},{},{}]}}` ## Import Events Retrieve a list of import events from ThreatQuotient ThreatQ using the specified import ID. ### Endpoint - **URL:** `api/imports/{{import_id}}/events` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Import Events action | | `parameters.offset` | number | Optional | Parameters for the Import Events action | | `parameters.sort` | string | Optional | Parameters for the Import Events action | | `parameters.with` | string | Optional | Parameters for the Import Events action | | `path_parameters.import_id` | number | Required | Parameters for the Import Events action | ### Input Example `{"parameters":{"limit":100,"offset":100,"sort":"id","with":"adversaries,attachments"},"path_parameters":{"import_id":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.import_id` | number | Response data | | `data.title` | string | Response data | | `data.description` | string | Response data | | `data.type_id` | number | Response data | | `data.happened_at` | string | Response data | | `data.status_id` | number | Response data | | `data.source` | string | Response data | | `data.whitelisted` | string | Response data | | `data.duplicate` | string | Response data | | `data.type` | object | Response data | | `data.type.id` | number | Response data | | `data.type.name` | string | Response data | | `data.type.user_editable` | string | Response data | | `data.type.created_at` | string | Response data | | `data.type.updated_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"data":[{},{}]}}` ## Indicator Search Performs a search for indicators within ThreatQuotient ThreatQ based on criteria specified in the provided JSON body. ### Endpoint - **URL:** `api/indicators/query` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.limit` | number | Optional | Parameters for the Indicator Search action | | `parameters.offset` | number | Optional | Parameters for the Indicator Search action | | `parameters.sort` | string | Optional | Parameters for the Indicator Search action | | `criteria` | object | Optional | Parameter for Indicator Search | | `criteria.+or` | array | Optional | Parameter for Indicator Search | | `criteria.+or.mentions` | string | Optional | Parameter for Indicator Search | | `criteria.+or.value` | object | Optional | Value for the parameter | | `criteria.+or.value.+contains` | string | Optional | Value for the parameter | | `filters` | object | Optional | Parameter for Indicator Search | | `filters.+and` | array | Optional | Parameter for Indicator Search | | `filters.+and.created_at` | object | Optional | Parameter for Indicator Search | | `filters.+and.created_at.+lt` | string | Optional | Parameter for Indicator Search | | `filters.+and.+or` | array | Optional | Parameter for Indicator Search | | `filters.+and.+or.+and` | array | Optional | Parameter for Indicator Search | | `filters.+and.+or.+and.source_name` | string | Optional | Name of the resource | | `filters.+and.+or.+and.source_created_at` | object | Optional | Parameter for Indicator Search | | `filters.+and.updated_at` | object | Optional | Parameter for Indicator Search | | `filters.+and.updated_at.+lt` | string | Optional | Parameter for Indicator Search | | `filters.+or` | array | Optional | Parameter for Indicator Search | | `filters.+or.attribute` | object | Optional | Parameter for Indicator Search | | `filters.+or.attribute.name` | string | Optional | Name of the resource | | `filters.+or.attribute.value` | string | Optional | Value for the parameter | ### Input Example `{"parameters":{"limit":100,"offset":100,"sort":"id"},"json_body":{"criteria":{"+or":[{"mentions":"org"},{"value":{"+contains":"test.com"}}]},"filters":{"+and":[{"created_at":{"+lt":"2021-01-27 22:35:00"}},{"+or":[{"expires_at":{"+gt":"2021-01-26 23:59:59","+lt":"2021-01-28 00:00:00"}},{"expired_at":{"+gt":"2021-01-26 23:59:59","+lt":"2021-01-28 00:00:00"}}]},{"+or":[{"type_name":"FQDN"}]},{"+or":[{"status_name":"Active"}]},{"+or":[{"cidr_ipv4":"19.34.212.155/8"}]},{"+or":[{"score":{"+gte":6,"+lte":8}}]},{"+or":[{"+and":[{"source_name":"Customer Admin"},{"published_at":{"+lt":"2021-01-27 22:50:00"}}]}]},{"+or":[{"related":{"id":1,"type":"indicator"}}]},{"+or":[{"related":{"object":"adversary"}}]},{"+or":[{"source_name":"Primary Contributor"}]},{"+or":[{"tags":"Internal"}]},{"updated_at":{"+lt":"2021-01-27 22:51:00"}},{"+or":[{"+and":[{"source_name":"Primary Contributor"},{"source_created_at":{"+lt":"2021-01-27 22:50:00"}}]}]}],"+or":[{"attribute":{"name":"Confidence","value":"High"}}]}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.class` | string | Response data | | `data.score` | number | Response data | | `data.value` | string | Response data | | `data.expires_calculated_at` | string | Response data | | `data.touched_at` | string | Response data | | `data.id` | number | Response data | | `data.updated_at` | string | Response data | | `data.published_at` | string | Response data | | `data.last_detected_at` | string | Response data | | `data.created_at` | string | Response data | | `data.status_id` | number | Response data | | `data.hash` | string | Response data | | `data.type_id` | number | Response data | | `data.adversaries` | array | Response data | | `data.adversaries.name` | string | Response data | | `data.type` | object | Response data | | `data.type.name` | string | Response data | | `data.type.id` | number | Response data | | `data.type.class` | string | Response data | | `data.status` | object | Response data | | `data.status.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"data":[{},{}],"offset":0,"limit":25}}` ## Indicator Search with Value Performs a search in ThreatQuotient ThreatQ for indicators matching a specified value. Requires 'value' parameter. ### Endpoint - **URL:** `api/indicators/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Indicator Search with Value action | | `parameters.offset` | number | Optional | Parameters for the Indicator Search with Value action | | `parameters.with` | string | Optional | Parameters for the Indicator Search with Value action | | `parameters.value` | string | Required | Parameters for the Indicator Search with Value action | ### Input Example `{"parameters":{"limit":100,"offset":100,"with":"adversaries,sources","value":"%test%"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.value` | string | Response data | | `data.hash` | string | Response data | | `data.class` | string | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.last_detected_at` | object | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | | `data.type` | object | Response data | | `data.type.id` | number | Response data | | `data.type.name` | string | Response data | | `data.status` | object | Response data | | `data.status.id` | number | Response data | | `data.status.name` | string | Response data | | `data.status.description` | string | Response data | | `limit` | number | Output field: limit | | `offset` | number | Output field: offset | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 30 Aug 2023 10:44:30 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Server":"Apache","X-Frame-Options":"SAMEORIGIN","Vary":"Authorization","Cache-Control":"no-cache","Content-Security-Policy":"frame-ancestors 'self';","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Set-Cookie":"threatq_api=eyJpdiI6In...` ## Indicators Query Retrieve a filtered list of indicators from ThreatQuotient ThreatQ based on specified filter parameters. ### Endpoint - **URL:** `/api/indicators/query` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------------------------- | | `parameters.limit` | string | Optional | The maximum number of results to return. | | `parameters.offset` | string | Optional | The number of results to skip before starting to return results. | | `parameters.rows` | string | Optional | The number of rows to return. | | `parameters.sort` | string | Optional | The field to sort the results by. | | `fields` | array | Optional | Parameter for Indicators Query | | `filters` | object | Optional | The filters to apply to the results. | | `filters.+or` | array | Optional | Parameter for Indicators Query | | `filters.+or.value` | string | Optional | The value to filter by. | | `criteria` | object | Optional | The criteria to apply to the results. | | `with` | string | Optional | The fields to include in the results. | ### Input Example `{"parameters":{"limit":"25","offset":"0","rows":"0","sort":"-created_at"},"json_body":{"fields":["*","score","sources.name","sources.tlp_id"],"filters":{"+or":[{"value":"baddomain.com"},{"value":"68.68.21.21"},{"value":"helloworld.com"},{"value":"161fb353ab7e67341fd6a767aa596676"}]},"criteria":{},"with":"adversaries,attachments,attributes,attributes.attribute,comments,events,indicators,score,signatures,sources,status,tags,type,events,malware,campaign,incident,ttp,attack_pattern,report,tool,vulnerability"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `data` | array | Response data | | `data.id` | number | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.class` | string | Response data | | `data.hash` | string | Response data | | `data.value` | string | Response data | | `data.last_detected_at` | string | Response data | | `data.expires_at` | object | Response data | | `data.expired_at` | object | Response data | | `data.expires_calculated_at` | object | Response data | | `data.created_at` | string | Response data | | `data.updated_at` | string | Response data | | `data.touched_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":7481,"data":[{},{},{}]}}` ## Update Import Indicator Updates an existing indicator within a specified import batch in ThreatQuotient ThreatQ, requiring import\_id and import\_indicator\_id. ### Endpoint - **URL:** `api/imports/{{import_id}}/indicators/{{import_indicator_id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.import_id` | number | Required | Parameters for the Update Import Indicator action | | `path_parameters.import_indicator_id` | number | Required | Parameters for the Update Import Indicator action | | `value` | string | Optional | Value for the parameter | | `type_id` | string | Optional | Unique identifier | | `status_id` | string | Optional | Unique identifier | | `source` | object | Optional | Parameter for Update Import Indicator | | `source.name` | string | Optional | Name of the resource | | `source.tlp` | object | Optional | Parameter for Update Import Indicator | | `source.tlp.name` | string | Optional | Name of the resource | | `whitelisted` | string | Optional | Parameter for Update Import Indicator | ### Input Example `{"json_body":{"value":"99.99.99.96","type_id":"10","status_id":"2","source":{"name":"Adversary source","tlp":{"name":"GREEN"}},"whitelisted":"Y"},"path_parameters":{"import_id":1,"import_indicator_id":2}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.import_id` | number | Response data | | `data.value` | string | Response data | | `data.hash` | string | Response data | | `data.type_id` | number | Response data | | `data.status_id` | number | Response data | | `data.source` | string | Response data | | `data.import_event_id` | object | Response data | | `data.whitelisted` | string | Response data | | `data.duplicate` | string | Response data | | `data.duplicate_indicator_id` | object | Response data | | `data.created_indicator_id` | object | Response data | | `data.parent_import_indicator_hash` | object | Response data | | `data.type` | object | Response data | | `data.type.id` | number | Response data | | `data.type.name` | string | Response data | | `data.type.class` | string | Response data | | `data.type.score` | object | Response data | | `data.type.wildcard_matching` | string | Response data | | `data.type.created_at` | string | Response data | | `data.type.updated_at` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"id":1133,"import_id":1,"value":"99.99.99.96","hash":"3f560465e1b9a5e1fee97b2fbf45de16","type_id":10,"status_id":2,"source":"New Source","import_event_id":null,"whitelisted":"Y","duplicate":"N","duplicate_indicator_id":null,"created_indicator_id":null,"parent_import_indicator_hash":null,"type":{}}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache | | Connection | HTTP response header: Connection | keep-alive | | Content-Security-Policy | HTTP response header: Content-Security-Policy | frame-ancestors 'self'; | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 31 Aug 2023 07:33:24 GMT | | Server | Information about the software used by the origin server | Apache | | Set-Cookie | HTTP response header: Set-Cookie | threatq\_api=eyJpdiI6IlR3RklqR2ZVXC9INXh4K25QUURqbTlRPT0iLCJ2YWx1ZSI6IjhuSlR5MWE1cnNUN1dodDcybXFIVnlyaVN2b0xKOHFTNk9HcmMrQlR0dWFjSHNxOTlFRWJSeHh1WXFOQjJUa295V2c0N1RyNVBQWkpmVkhLTWtOdkV3PT0iLCJtYWMiOiJiYmEwMzcyOGY0NzhmNTJiMDQwNTE3NjczMDVkMzQ2OWZjMDU1Mjc4NzQ1MWYzYjNiYTY2ZjA5ZjAzMGRlZTg5In0%3D; expires=Thu, 31-Aug-2023 08:33:24 GMT; Max-Age=3600; path=/api/; secure; HttpOnly; SameSite=strict | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Authorization | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |