ThreatConnect Groups API

The Groups API from ThreatConnect — 9 operation(s) for groups.

Documentation GitHub OpenAPI

Operations 13

GET /api/v3/groups/{groupid}/upload GET /api/v3/groups/{groupId}/upload #

GET /v2/groups/incidents/{incidentid} Retrieve Incident status (includeAdditional) #

GET /v2/groups/{groupid} Retrieve Multiple Groups of type campaigns #

GET /v2/groups/{grouptype}/{groupid}/attributes Attributes are key/value data sets that can be added to any Group, Indicator… #

POST /v2/groups/{grouptype}/{groupid}/attributes Attributes are key/value data sets that can be added to any Group, Indicator… #

DELETE /v2/groups/{grouptype}/{groupid}/attributes/{attributeid} Deleting Attributes #

PUT /v2/groups/{grouptype}/{groupid}/attributes/{attributeid} Attributes are key/value data sets that can be added to any Group, Indicator… #

POST /v3/groups Create an Object in a Community or Source #

DELETE /v3/groups/{groupxid} Groups — ThreatConnect Developer Docs latest documentation #

PUT /v3/groups/{groupxid} Groups — ThreatConnect Developer Docs latest documentation #

POST /v3/groups/{groupxid}/upload Groups — ThreatConnect Developer Docs latest documentation #

PUT /v3/groups/{groupxid}/upload Groups — ThreatConnect Developer Docs latest documentation #

GET /v3/groups/{groupxid}/{id} Groups — ThreatConnect Developer Docs latest documentation #

Specifications

⚙

OpenAPI

https://artifacts.apis.io/threatconnect/openapi/threatconnect-groups-api-openapi.yml

Schemas & Data

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v3-groups-response-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-notifications-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-custommetrics-taskscompleted-data-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-get-tc-taxii-collections-collectionid-or-ownername-response-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-put-v3-indicators-ultrabadguy-com-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-groups-grouptype-groupid-attributes-request-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/threatconnect:threatconnect-groups-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: ThreatConnect Groups API
  version: '2026-10-14'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-14: 55 operation(s) read from 31 public documentation page(s) (each operation names its page in x-source). This is not the provider''s published contract; ThreatConnect has published no machine-readable contract that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 8
    documentation: 47
    pages-with-code: 5
    pages-read: 31
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-14'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://docs.threatconnect.com/en/latest/rest_api/v2/tasks/tasks.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/groups/groups.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/victims/victims.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/batch_api/batch_api.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/playbooks/playbooks.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/notifications/notifications.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/custom_metrics/custom_metrics.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/security_labels/security_labels.html
  - https://docs.threatconnect.com/en/latest/rest_api/overview.html
  - https://docs.threatconnect.com/en/latest/rest_api/quick_start.html
  - https://docs.threatconnect.com/en/latest/rest_api/taxii/taxii_2.1.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/tc_exchange_administration/tc_exchange_administration.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/associations.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/bulk_delete.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/enable_pagination.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/filter_results.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/additional_fields.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/return_count.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/sort_results.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/specify_owner.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/update_metadata.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/artifacts/artifacts.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/case_attributes/case_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/cases/cases.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/workflow_templates/workflow_templates.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/group_attributes/group_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_attributes/indicator_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_enrichment/indicator_enrichment.html
servers:
- url: https://companyabc.threatconnect.com
security:
- TC-Token: []
tags:
- name: Groups
paths:
  /api/v3/groups/{groupid}/upload:
    get:
      operationId: get_api_v3_groups_groupid_upload
      tags:
      - Groups
      summary: GET /api/v3/groups/{groupId}/upload
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      - name: filename
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV3GroupsGroupidUploadResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -- location -- request POST 'https://app.threatconnect.com/api/v3/groups/25/upload?filename=report.pdf'  -- header 'Timestamp: $UNIX_EPOCH_TIMESTAMP'  -- header 'Authorization: TC $ACCESS_ID:$SIGNATURE'  -- header 'Content-Type: application/octet-stream'  -- data '@/Users/jsmith/Desktop/report.pdf' \n Response \n { \n \"message\" : \"Upload successful\" , \n \"status\" : \"Success\" \n } \n Update a Docume"
  /v2/groups/incidents/{incidentid}:
    get:
      operationId: get_v2_groups_incidents_incidentid
      tags:
      - Groups
      summary: Retrieve Incident status (includeAdditional)
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/groups/groups.html
      parameters:
      - name: incidentid
        in: path
        required: true
        schema:
          type: string
      - name: includeAdditional
        in: query
        required: false
        schema:
          type: boolean
        description: When true, returns additional incident data such as status
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV2GroupsIncidentsIncidentidResponse'
      x-evidence:
        kind: documentation
  /v2/groups/{groupid}:
    get:
      operationId: get_v2_groups_groupid
      tags:
      - Groups
      summary: Retrieve Multiple Groups of type campaigns
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/groups/groups.html
      parameters:
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      - name: filters
        in: query
        required: false
        schema:
          type: string
        description: URL‑encoded filter expression for campaigns, e.g. firstSeen%3E2017-07-13T00:00
      - name: owner
        in: query
        required: false
        schema:
          type: string
        description: Owner name
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV2GroupsGroupidResponse'
      x-evidence:
        kind: documentation
        collapsed_from: 3 example path(s) differing only at groupId
  /v2/groups/{grouptype}/{groupid}/attributes:
    get:
      operationId: get_v2_groups_grouptype_groupid_attributes
      tags:
      - Groups
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: grouptype
        in: path
        required: true
        schema:
          type: string
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_v2_groups_grouptype_groupid_attributes
      tags:
      - Groups
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: grouptype
        in: path
        required: true
        schema:
          type: string
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV2GroupsGrouptypeGroupidAttributesRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/groups/{grouptype}/{groupid}/attributes/{attributeid}:
    delete:
      operationId: delete_v2_groups_grouptype_groupid_attributes_attributeid
      tags:
      - Groups
      summary: Deleting Attributes
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: grouptype
        in: path
        required: true
        schema:
          type: string
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      - name: attributeid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    put:
      operationId: put_v2_groups_grouptype_groupid_attributes_attributeid
      tags:
      - Groups
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: grouptype
        in: path
        required: true
        schema:
          type: string
      - name: groupid
        in: path
        required: true
        schema:
          type: string
      - name: attributeid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutV2GroupsGrouptypeGroupidAttributesAttributeidRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v3/groups:
    post:
      operationId: post_v3_groups
      tags:
      - Groups
      summary: Create an Object in a Community or Source
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/specify_owner.html
      parameters:
      - name: owner
        in: query
        required: true
        schema:
          type: string
        description: Name of the owner (Organization, Community, or Source) where the object will be created.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV3GroupsRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV3GroupsResponse'
      x-evidence:
        kind: documentation
  /v3/groups/{groupxid}:
    delete:
      operationId: delete_v3_groups_groupxid
      tags:
      - Groups
      summary: Groups — ThreatConnect Developer Docs latest documentation
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupxid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    put:
      operationId: put_v3_groups_groupxid
      tags:
      - Groups
      summary: Groups — ThreatConnect Developer Docs latest documentation
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupxid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v3/groups/{groupxid}/upload:
    post:
      operationId: post_v3_groups_groupxid_upload
      tags:
      - Groups
      summary: Groups — ThreatConnect Developer Docs latest documentation
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupxid
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    put:
      operationId: put_v3_groups_groupxid_upload
      tags:
      - Groups
      summary: Groups — ThreatConnect Developer Docs latest documentation
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupxid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v3/groups/{groupxid}/{id}:
    get:
      operationId: get_v3_groups_groupxid_id
      tags:
      - Groups
      summary: Groups — ThreatConnect Developer Docs latest documentation
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
      parameters:
      - name: groupxid
        in: path
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
        collapsed_from: 2 example path(s) differing only at id
components:
  schemas:
    PostV3GroupsResponse:
      type: object
      properties:
        data.id:
          type: integer
          description: Unique identifier of the created group.
        data.dateAdded:
          type: string
          description: Timestamp when the group was added.
        data.ownerId:
          type: integer
          description: Identifier of the owner.
        data.ownerName:
          type: string
          description: Name of the owner.
        data.webLink:
          type: string
          description: Web link to the group details.
        data.type:
          type: string
          description: Group type.
        data.name:
          type: string
          description: Group name.
        data.createdBy.id:
          type: integer
          description: Identifier of the user who created the group.
        data.createdBy.userName:
          type: string
          description: User name of the creator.
        data.upVoteCount:
          type: string
          description: Number of up‑votes.
        data.downVoteCount:
          type: string
          description: Number of down‑votes.
        data.lastModified:
          type: string
          description: Timestamp of the last modification.
        data.legacyLink:
          type: string
          description: Legacy link to the group.
        message:
          type: string
          description: Result message.
        status:
          type: string
          description: Result status.
    GetV2GroupsIncidentsIncidentidResponse:
      type: object
      properties:
        status:
          type: string
        data.incident:
          type: object
          description: Incident object with fields like id, name, status, etc.
    GetApiV3GroupsGroupidUploadResponse:
      type: object
      properties:
        message:
          type: string
        status:
          type: string
    GetV2GroupsGroupidResponse:
      type: object
      properties:
        status:
          type: string
        data.resultCount:
          type: integer
        data.campaign[]:
          type: array
          description: Array of campaign group objects
    PostV3GroupsRequest:
      type: object
      properties:
        type:
          type: string
          description: The type of group to create (e.g., Adversary).
        name:
          type: string
          description: The name of the group.
      required:
      - type
      - name
    PutV2GroupsGrouptypeGroupidAttributesAttributeidRequest:
      type: object
      properties:
        value:
          type: string
          description: ‘Updated description.’
        displayed:
          type: string
          description: 'true'
        source:
          type: string
          description: ‘Hybrid Analysis’
      required:
      - value
    PostV2GroupsGrouptypeGroupidAttributesRequest:
      type: object
      properties:
        type:
          type: string
          description: ‘Description’
        value:
          type: string
          description: ‘Example description.’
        displayed:
          type: string
          description: 'true'
        source:
          type: string
          description: ‘Hybrid Analysis’
      required:
      - type
      - value
  securitySchemes:
    TC-Token:
      type: apiKey
      in: header
      name: Authorization
      x-source: https://docs.threatconnect.com/en/latest/tcex/authorization.html