MalwareThreatMapRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-malware-threat-map-request-schema.json",
  "title": "MalwareThreatMapRequest",
  "description": "Malware threat map filters",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/recorded-future-threat-api-openapi.yml#/components/schemas/MalwareThreatMapRequest",
  "type": "object",
  "properties": {
    "malware": {
      "description": "An array of malware entity IDs. If used, the API response will be limited to only those malware whose entity IDs match those found in the array. To lookup a malware entity ID, use the Entity Match API.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "categories": {
      "description": "An array of malware category entity IDs. If used, the API response will be filtered to only those malware whose category (e.g., Adware, Ransomware, Spyware) matches those found in the array. Categories must be listed by their Recorded Future Entity ID, which can be found by using the Malware Categories endpoint within the Threat API.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "watchlists": {
      "description": "An array of client specific watch list IDs. If used, the API response will be limited to only those threat actors whose link to the threat map is via the watch lists included. To lookup a watch list ID, use the List API.",
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}