Include Additional Fields in API Responses

Overview

When creating, retrieving, or updating data, you can use the fields query parameter to include additional fields that are not included in the API response by default.

To use the fields query parameter, append ?fields={fieldName} to the end of the request URL. To include multiple fields in the API response, separate each key-value pair with an ampersand (&). For example, to include data for associated Groups and Tags in an API response, append ?fields=associatedGroups&fields=tags to the end of the request URL.

Retrieve a List of Available Fields for an Endpoint

Send a request in the following format to retrieve a list of fields you can include in responses returned from an object’s endpoint:

OPTIONS /v3/{objectType}/fields

For example, the following request will retrieve a list of fields you can include in responses returned from the /v3/indicators endpoint:

OPTIONS /v3/indicators/fields

JSON Response

{
    "data": [
        {
            "description": "Includes artifacts with a relationship to the indicator",
            "includedByDefault": false,
            "name": "associatedArtifacts"
        },
        {
            "description": "Includes cases with a relationship to the indicator",
            "includedByDefault": false,
            "name": "associatedCases"
        },
        {
            "description": "Includes groups related to the indicator",
            "includedByDefault": false,
            "name": "associatedGroups"
        },
        {
            "description": "Includes indicators related to the indicator",
            "includedByDefault": false,
            "name": "associatedIndicators"
        },
        {
            "description": "Includes the name of the association if this indicator is part of an association with another indicator",
            "includedByDefault": false,
            "name": "associationName"
        },
        {
            "description": "Includes attributes related to the indicator",
            "includedByDefault": false,
            "name": "attributes"
        },
        {
            "description": "Includes indicators with custom associations to the indicator",
            "includedByDefault": false,
            "name": "customAssociations"
        },
        {
            "description": "Includes DNS resolution data related to the Host indicators",
            "includedByDefault": false,
            "name": "dnsResolution"
        },
        {
            "description": "Includes Enrichment data related to the indicator",
            "includedByDefault": false,
            "name": "enrichment"
        },
        {
            "description": "Includes date fields defined in external applications",
            "includedByDefault": false,
            "name": "externalDates"
        },
        {
            "description": "Includes the False Positives fields falsePositives and lastFalsePositive",
            "includedByDefault": false,
            "name": "falsePositives"
        },
        {
            "description": "Includes indicators related to the indicator by file action",
            "includedByDefault": false,
            "name": "fileActions"
        },
        {
            "description": "Includes file occurrences related to the indicator",
            "includedByDefault": false,
            "name": "fileOccurrences"
        },
        {
            "description": "Includes the following fields, over-writing the custom field names: value1, value2, and value3",
            "includedByDefault": false,
            "name":