API Reference

List Techniques

Return MITRE ATT&CK Enterprise techniques, optionally filtered by tactic shortname. Results are sorted by technique ID and capped by limit.

GET

/v1/mitre/techniques

Cost: 1 credit per successful call

Query parameters

tacticstringoptionaldefault (all tactics)

Tactic shortname to filter by. Maximum 60 characters, pattern ^[a-z0-9-]+$. Examples: initial-access, execution, lateral-movement, privilege-escalation. Lowercased server-side. Omit to return techniques across all tactics.

limitintegeroptionaldefault 100

Maximum number of techniques to return. Accepted range: 1–200.

Request

curl "https://api.edgeprotect.io/functions/v1/mitre/techniques?tactic=execution&limit=50" \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY"

Response

{
  "data": {
    "count": 14,
    "tactic": "execution",
    "limit": 50,
    "items": [
      {
        "technique_id": "T1059",
        "name": "Command and Scripting Interpreter",
        "platforms": ["Linux", "Windows", "macOS"],
        "phases": ["execution"],
        "is_subtechnique": false,
        "parent_technique": null
      },
      {
        "technique_id": "T1059.001",
        "name": "PowerShell",
        "platforms": ["Windows"],
        "phases": ["execution"],
        "is_subtechnique": true,
        "parent_technique": "T1059"
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of techniques returned (equals items.length).

data.tacticstring | nulloptional

The tactic shortname used to filter this request. null when no filter was applied.

data.limitintegeroptional

The maximum number of techniques requested.

data.itemsarrayoptional

Techniques matching the filter, sorted by technique ID. Each object contains the fields below.

data.items[].technique_idstringoptional

The canonical ATT&CK technique identifier (e.g. T1059.001).

data.items[].namestringoptional

Human-readable technique name.

data.items[].platformsarrayoptional

Operating systems and environments where the technique applies.

data.items[].phasesarrayoptional

ATT&CK tactic shortnames this technique falls under.

data.items[].is_subtechniquebooleanoptional

true if this entry is a sub-technique (identifier contains a dot).

data.items[].parent_techniquestring | nulloptional

Parent technique identifier for sub-techniques. null for top-level techniques.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_tactic`	`tactic` contains characters outside `^[a-z0-9-]+$` or exceeds 60 characters.
400	`invalid_limit`	`limit` is not an integer in the range 1–200.
401	`invalid_authorization`	The `Authorization` header is missing or malformed.
401	`unauthorized`	The key is invalid, revoked, or the request IP is not on the allowlist.
402	`insufficient_credits`	The organisation's credit balance is below 1.
404	`not_found`	The route does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference.