> ## Documentation Index > Fetch the complete documentation index at: https://docs.threatbook.io/llms.txt > Use this file to discover all available pages before exploring further. # Report List > Retrieves a paginated list of threat intelligence reports from ThreatBook Lab and open-source intelligence sources. ## OpenAPI ````yaml api-reference/reports/report-list.openapi.json POST /v3/reports/list openapi: 3.1.0 info: title: Default module description: '' version: 1.0.0 servers: - url: https://api.threatbook.io security: [] tags: [] paths: /v3/reports/list: post: tags: [] summary: Report List description: >- Retrieves a paginated list of threat intelligence reports from ThreatBook Lab and open-source intelligence sources. parameters: - name: apikey in: query description: >- Your API key. For details on how to obtain and manage your API key, please refer to the [Authentication](https://docs.threatbook.io/api-reference/authentication) page. **Kindly note:** Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it. required: true example: '' schema: type: string requestBody: required: false content: application/json: schema: type: object properties: query: type: string description: >- Keyword search parameter that matches across multiple indexed fields, including report title, summary, tags, IOCs, CVE identifiers and names, target products, target organizations, and other relevant attributes. threat_type_list: type: array items: type: string description: >- Specifies one or more threat event types to filter reports. Multiple values should be passed as a JSON array of strings (String[]).For the list of supported threat event types, please refer to the [Threat Report Glossaries](/guide/reports-glossaries). *Note: This parameter is only applicable to reports belonging to the **Incident Analysis** category.* severity_list: type: array items: type: string description: >- Specifies one or more severity levels to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Supported levels include: - **critical** - **high** - **low** If not provided, reports of all severity levels will be returned. category_list: type: array items: type: string description: >- Specifies one or more report content categories to filter results. Multiple values should be passed as a JSON array of strings (String[]). Supported categories include: - **Incident Analysis** - **Malware Analysis** - **Vulnerability Analysis** - **Summary Report** - **Security News** - **Incident Response** threat_actor_list: type: array items: type: string description: >- Specifies one or more threat actors to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Example values include names of known threat groups such as **Lazarus**, **APT41**, etc. target_region_list: type: array items: type: string description: >- Specifies one or more target countries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). target_region_code: type: array items: type: string description: >- Specifies one or more target countries to filter reports using ISO 3166-1 alpha-2 country codes (e.g., `US`, `CN`, `GB`). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the [ISO Online Browsing Platform](https://www.iso.org/obp/ui/#search). target_industry_list: type: array items: type: string description: >- Specifies one or more target industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the **STIX II industry taxonomy** (e.g., *financial-services*, *government*, *technology*, etc.). For the list of supported industries, please refer to the [Reports Glossaries](/guide/reports-glossaries). target_org_list: type: array items: type: string description: >- Specifies one or more targeted organizations referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]). target_product_list: type: array items: type: string description: >- Specifies one or more targeted products referenced in the reports. Multiple values should be passed as a JSON array of strings (String[]). Examples include product names such as *OpenSSH*, *Exchange Server*. industry_of_target_org: type: array items: type: string description: >- Specifies one or more targeted organizations' industries to filter reports. Multiple values should be passed as a JSON array of strings (String[]). Industry names follow the **STIX II industry taxonomy** (e.g., *financial-services*, *government*, *technology*, etc.). For the list of supported industries, please refer to the [Reports Glossaries](/guide/reports-glossaries). hq_region_of_target_org: type: array items: type: string description: >- Specifies one or more targeted organizations' headquarters regions using ISO 3166-1 alpha-2 country codes (e.g., `US`, `CN`, `GB`). Multiple values should be passed as a JSON array of strings (String[]). For a full list of codes, refer to the [ISO Online Browsing Platform](https://www.iso.org/obp/ui/#search). has_iocs: type: boolean description: >- Indicates whether to return only reports that contain IOC information. - **true**, only reports with IOC data will be returned. - **false** or omitted, all reports will be included by default. has_cves: type: boolean description: >- Indicates whether to return only reports that contain CVE information. - **true**, only reports with CVE data will be returned. - **false** or omitted, all reports will be included by default. has_rules: type: boolean description: >- Indicates whether to return only reports that contain detection rules. - **true**, only reports with detection rule data will be returned. - **false** or omitted, all reports will be included by default. published_from: type: string description: >- Specifies the start of the report publication time range (inclusive). Supports ISO8601 datetime format, e.g., `2024-09-01T00:00:00Z`. published_to: type: string description: >- Specifies the end of the report publication time range (inclusive). Supports ISO8601 datetime format, e.g., `2024-10-01T00:00:00Z`. from_tb_lab: type: boolean description: >- Indicates whether to return only ThreatBook Lab exclusive reports. - **true**, only ThreatBook Lab–originated reports will be returned. - **false** or omitted, all reports (including open-source intelligence) will be included by default. limit: type: integer description: >- Specifies the number of records to return per page. The default value is **20**, and the maximum allowed value is **100**. cursor: type: string description: >- Specifies the pagination cursor used to retrieve the next page of results. If omitted, the first page of results will be returned. responses: '200': description: '' content: application/json: schema: type: object properties: data: type: object properties: cursor: type: string description: >- Cursor value used to retrieve the next page of results. If empty, it indicates that no additional data is available. total: type: integer description: Total number of records that match the query filters. limit: type: integer description: Number of records returned in the current page. items: type: array items: type: object properties: id: type: string description: >- Unique identifier of the report. Used to query report details. title: type: string description: Title of the threat intelligence report. summary: type: string description: >- A summary describing the highlights of the report. source: type: string description: >- Indicates the origin of the report. Values include **ThreatBook Lab** (exclusive content) or **Open Source**. published_time: type: string description: >- Publication time of the report in ISO8601 format. event_time: type: string description: >- Time of the associated incident or threat activity. May be aggregated to day, month, or year depending on source data. severity: type: string description: >- Severity level of the report (e.g., `low`, `high`, `critical`). organizations: type: array items: type: string description: >- List of affected organizations referenced in the report. target_orgs: type: array description: >- Detailed list of targeted organizations containing rich entity attributes. items: type: object properties: org_name: type: string description: The name of the targeted organization. website: type: string description: >- The official website domain of the targeted organization. org_industry: type: array items: type: string description: >- List of industries the targeted organization belongs to based on STIX II taxonomy (e.g., *financial-services*, *government*, *technology*, etc.). For the list of supported industries, please refer to the [Reports Glossaries](/guide/reports-glossaries). hq_region: type: array items: type: string description: >- List of headquarters regions or countries of the targeted organization using ISO 3166-1 alpha-2 country codes (e.g., `US`, `CN`, `GB`). For a full list of codes, refer to the [ISO Online Browsing Platform](https://www.iso.org/obp/ui/#search). required: - org_name regions: type: array items: type: string description: >- List of affected regions or countries referenced in the report. industries: type: array items: type: string description: >- List of affected industries based on STIX II industry taxonomy. For the list of supported industries, please refer to the [Reports Glossaries](/guide/reports-glossaries). products: type: array items: type: string description: >- List of affected products referenced in the report. threat_type: type: array items: type: string description: >- One or more threat event types associated with the report. tags: type: array items: type: string description: >- Set of extracted intelligence tags associated with the report. Currently supported tag categories include: - **Threat Actors** - **Malware Families** - **Attack Tools** cve_stats: type: integer description: >- Total number of CVE identifiers referenced in the report. reference_link: type: array items: type: string description: >- One or more external source URLs related to the report. ioc_stats: type: object properties: ip: type: integer domain: type: integer hash: type: integer url: type: integer required: - ip - domain - hash - url description: >- Statistics of IOCs contained in the report, including the count of IPs, domains, hashes and URLs. required: - id - title - summary - source - published_time - event_time - severity - organizations - target_orgs - regions - industries - products - threat_type - tags - cve_stats - reference_link - ioc_stats required: - cursor - total - limit - items response_code: type: integer msg: type: string description: 'Allowed value: "Success"' required: - data - response_code - msg example: data: cursor: >- d19ba003fbc998df0d299f2ff41607ad2ce6ecc2a573f5e0a152bedaa8ff2f591ef5329521d6e2ddbd5646a56918d3b33f652e36ab05bde0fd78000e27c7caccd3ecd8903b1914e4c2858f93ffe27a773ed388a338b65e40dcf0b7745e0df41a3ede6a33a561f100d522ce9a00af42103a728e2d0fbdbabced7ea70a4702640e83d03a2d48481e215d635c2292984be2bb6ecb35e5c5a1a7c08b4d8599a74d8efa0ee76153b83c8c985b7df1d6143c18b14a851faf7059a6ce448ecefd801911ff6433d234d4b21368d1297271eeab6bbcbb4b01608756b024779f600b33cd88c3bc08250a29c0125ff9d97f2f103a061b78d9282a080849262ce8718ae7b59f25f26a09213f1cee20110c82651b96341db0f09c0969896b6d9beb3bc7538812 total: 2753 limit: 20 items: - id: '303012' title: >- Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group summary: >- In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a ripple effect on societal infrastructure, highlighting the urgency of cybersecurity protection. source: Open Source published_time: '2025-11-25T00:00:00Z' event_time: '2025-09-17' severity: Critical organizations: - Volkswagen France - Echo Lake Foods, Inc. target_orgs: - org_name: Volkswagen France website: volkswagen.fr org_industry: - Automotive - Manufacturing hq_region: - FR - org_name: Echo Lake Foods, Inc. website: echolakefoods.com org_industry: - Food & Beverage - Manufacturing hq_region: - US regions: - Netherlands - United States - Japan - UAE - Mexico - Italy - France industries: - Healthcare - Manufacturing - Government products: [] threat_type: - Ransomware tags: - Qilin cve_stats: 0 reference_link: - https://www.dexpose.io/free-darkweb-report/ - https://www.dexpose.io/email-data-breach-scan/ - >- https://cybernews.com/news/bmw-ransomware-attack-everest-claim-everest-luxury-target-jlr-trend/ - >- https://cybernews.com/security/production-process-of-jaguar-land-rover-disrupted-by-cyberattack/ - >- https://cybernews.com/security/jaguar-jlr-cyberattack-claimed-by-salesforce-hackers-scattered-spider-shiny-hunters/ - >- https://cybernews.com/security/massive-salesforce-breach-campaign-started-on-github/ - >- https://cybernews.com/news/marks-spencer-breach-tcs-third-party-vendor-social-engineering-attack/ - >- https://cybernews.com/news/jaguar-land-rover-production-down-for-at-least-another-week-due-to-cyberattack/ - >- https://cybernews.com/security/bridgestone-cyberattack-auto-manufacturer-disrupted-jaguar-link/ - https://cybernews.com/ransomlooker/ - >- https://cybernews.com/security/texas-electric-coops-ransomware-attack/ - >- https://cybernews.com/news/asahi-beer-cyberattack-claimed-qilin-ransomware-stolen-data/ - >- https://cybernews.com/news/cal-club-ransomware-attack-california-golf-club-san-franscico-qilin-claims/ - >- https://cybernews.com/news/israel-shamir-medical-center-ransowmare-attack-qilin-8t-patient-data-stolen/ - >- https://cybernews.com/news/nissan-ransomware-attack-creative-box-creative-box-radesign-studio-qilin-group/ - >- https://cybernews.com/news/inotiv-ransomware-attack-qilin-pharma-research-testing-animal-cruelty-fines/ - >- https://cybernews.com/security/singer-associates-ransomware-attack-qilin/ - >- https://cybernews.com/news/sk-group-ransomware-attack-qilin-gang-claims-stolen-data/ - >- https://cybernews.com/security/lee-enterprises-cyberattack-impact/ - >- https://cybernews.com/news/houston-symphony-qilin-ransomware-attack/ - >- https://cybernews.com/security/television-station-detroit-pbs-hacked/ - >- https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/ - >- https://cybernews.com/news/cancer-hospital-breach-is-claimed-by-qilin-gang-in-new-ransomware-low/ - https://botcrawl.com/category/data-breaches/ response_code: 200 msg: Success headers: {} '204': description: '' content: {} '400': description: '' content: application/json: schema: type: object properties: msg: type: string enum: - Required:{resource/apikey} - Invalid parameter:{parameter} response_code: type: integer const: 400 required: - msg - response_code examples: Example 1: summary: Example 1 value: msg: Required:{resource/apikey} response_code: 400 '401': description: '' content: application/json: schema: type: object properties: msg: type: string enum: - Invalid account status - 'Invalid access IP: {actual IP address}' - Invalid API key - Invalid key status - No access to the API - Expired API key - No access to the requested resource - 'No access to: {parameter}' response_code: type: integer const: 401 required: - msg - response_code examples: Example 1: summary: Example 1 value: msg: Invalid account status response_code: 401 '405': description: '' content: application/json: schema: type: object properties: msg: type: string const: Invalid API method response_code: type: integer const: 405 required: - msg - response_code examples: Example 1: summary: Example 1 value: msg: Invalid API method response_code: 405 '429': description: '' content: application/json: schema: type: object properties: msg: type: string enum: - Request rate limitation - Beyond {daily/monthly/total} quotas limitation response_code: type: integer const: 429 required: - msg - response_code examples: Example 1: summary: Example 1 value: msg: Request rate limitation response_code: 429 '500': description: '' content: application/json: schema: type: object properties: msg: type: string enum: - System error - URL Download Fail response_code: type: integer const: 500 required: - msg - response_code examples: Example 1: summary: Example 1 value: msg: System error response_code: 500 deprecated: false security: [] ````