# Recorded Future Documentation

> Recorded Future API documentation

## API Reference
- [Recorded Future API Overview](https://docs.recordedfuture.com/reference/get-started.md)
- [API Entitlements](https://docs.recordedfuture.com/reference/api-entitlements.md)
- [LLM Instructions](https://docs.recordedfuture.com/reference/llm-instructions.md)
- [Fetch alert by id](https://docs.recordedfuture.com/reference/alerts-get-by-id.md): Retrieve a single alert by ID, including triage state, triggering rule, and the intelligence hits that activated it.
- [Fetch a flat collection of hits](https://docs.recordedfuture.com/reference/alerts-get-hits.md): Retrieve a flat array of intelligence hits across one or more alerts for bulk processing, each tagged to its parent alert.
- [Fetch raw image data](https://docs.recordedfuture.com/reference/alerts-get-image.md): Download the raw PNG image tied to an alert hit, primarily used for brand-protection evidence like fake apps or impersonated domains.
- [Search for alerts](https://docs.recordedfuture.com/reference/alerts-search.md): Search and filter alerts by time range, review status, alert rule, assignee, or freetext, with paginated results sorted by trigger time.
- [Search for alert rules.](https://docs.recordedfuture.com/reference/alerts-search-rules.md): Search and list configured alert rules by freetext filter to discover rule IDs for use in alert queries.
- [Update one or several alerts](https://docs.recordedfuture.com/reference/alerts-update.md): Batch-update assignee, workflow status, and notes across one or more classic alerts in a single request.
- [Search for Playbook Alerts](https://docs.recordedfuture.com/reference/playbook-alerts-search.md): Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's value. Only  Playbook Alerts matching all specified criteria are included in the response.
- [Preview Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-preview.md): Returns a Playbook Alert representation containing only properties shared between all alert types.
- [Update Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-update.md): Update a Playbook Alert. Generic alert properties like status, priority and assignee may be updated, or a log message may be appended.
- [Available assignees](https://docs.recordedfuture.com/reference/playbook-alerts-assignees.md): List all users that are available as possible assignees for a given Playbook Alert
- [Enumerations](https://docs.recordedfuture.com/reference/playbook-alerts-metadata.md): List all metadata and enumerations common to all types of Playbook Alerts.
- [Detailed Domain Abuse alert data](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-detail.md): Retrieve detailed information about a Domain Abuse Playbook Alert with data grouped into UI-ready panels.
- [Bulk Domain Abuse alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- [Screenshot related to Domain Abuse alert](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-image.md): Fetch a screenshot associated with the Domain Abuse alert.
- [Playbook Alerts: Malicious Sites Detail](https://docs.recordedfuture.com/reference/post_malicious-sites-playbook-alert-id.md): Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels.
- [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites.md): Batch-retrieve detailed intelligence for up to 250 Malicious Sites alerts in a single request.
- [Playbook Alerts: Malicious Sites Screenshot](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id.md): Fetch a screenshot associated with the Malicious Sites alert.
- [Playbook Alerts: Malicious Sites Create](https://docs.recordedfuture.com/reference/post_malicious-sites-create.md): Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request.  If the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one.  Provide exactly one of `rule` or `organization` to select the use case configuration the alert is created under.
- [Detailed Vulnerability alert data](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-detail.md): Retrieve detailed information about a Vulnerability Playbook Alert with data grouped into UI-ready panels.
- [Bulk Vulnerability alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- [Detailed Code Repository Data Leakage alert data](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-detail.md): Retrieve detailed information about a Code Repository Data Leakage Playbook Alert with data grouped into UI-ready panels.
- [Bulk Code Repository Data Leakage alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- [Third Party Risk alert data](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-detail.md): Retrieve detailed information about a Third Party Risk Playbook Alert with data grouped into UI-ready panels.
- [Bulk Third Party Risk alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- [Detailed Identity Novel Exposures alert data](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-detail.md): Retrieve detailed information about a Identity Novel Exposures Playbook Alert with data grouped into UI-ready panels.
- [Bulk Identity Novel Exposures alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-bulk.md): Perform a detailed lookup of data panels for several Identity Novel Exposures alerts at once.
- [Bulk Geopolitics Facility alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-bulk.md): Perform a detailed lookup of data panels for several Geopolitics Facility alerts at once.
- [Geopolitics Facility alert data](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-detail.md): Retrieve detailed information about a Geopolitics Facility with data grouped into UI-ready panels.
- [Image content by image id](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-image.md): Fetch an image content by image id
- [Malware Report alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-detail.md): Retrieve detailed information about a Malware report notification with data grouped into UI-ready panels.
- [Bulk Malware Report alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-bulk.md): Retrieve detailed information about multiple Malware Report notifications with data grouped into UI-ready panels.
- [Compromised Bank Checks alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-detail.md): Retrieve detailed information about a compromised bank check notification with data grouped into UI-ready panels.
- [Bulk Compromised Bank Checks alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-bulk.md): Retrieve detailed information about multiple compromised bank check notifications with data grouped into UI-ready panels.
- [Check image by alert id](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-image.md): Fetch a compromised bank check image content by alert id
- [Build a Case around a Reference Alert, or a Signal Alert](https://docs.recordedfuture.com/reference/cases-create.md): Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation.
- [Deletes one Case](https://docs.recordedfuture.com/reference/cases-delete.md): Permanently remove a single case by its ID (idempotent — already-deleted or non-existent cases return success).
- [Deletes specified Cases](https://docs.recordedfuture.com/reference/cases-delete-many.md): Bulk-delete up to 100 cases by ID, with partial-success handling that distinguishes deleted from already-removed cases.
- [Lookup of Cases using Case IDs](https://docs.recordedfuture.com/reference/cases-lookup-many.md): Retrieve full case details (metadata, alert context, activity history) for one or more cases by their IDs.
- [Lookup a Case using its ID](https://docs.recordedfuture.com/reference/cases-lookup.md): Retrieve full case details for a single case by ID (known routing bug — prefer POST /lookup with a single ID instead).
- [Searches for any Case matching the criteria](https://docs.recordedfuture.com/reference/cases-search.md): Search cases by filter criteria to get matching case IDs, which can then be passed to the lookup endpoint for full details.
- [Update Assignee, Status, Priority, Title or Description of a Case](https://docs.recordedfuture.com/reference/cases-update.md): Update assignee, status, priority, title, or description on an existing case.
- [Retrieve all eligible assignees for a Case](https://docs.recordedfuture.com/reference/cases-eligible-assignees.md): List users in an organization who are eligible to be assigned to a specific case, with optional name or email filtering.
- [Analyst Notes: Available Topics](https://docs.recordedfuture.com/reference/analyst-note-available-topics.md)
- [Analyst Notes: Note Attributes](https://docs.recordedfuture.com/reference/analyst-note-note-attributes.md)
- [Analyst Notes: Serialization Options](https://docs.recordedfuture.com/reference/analyst-note-serialization-options.md)
- [Analyst Notes: Search](https://docs.recordedfuture.com/reference/analyst-note-search.md): Search published analyst notes from your enterprise and Insikt Group.
- [Analyst Notes: Lookup](https://docs.recordedfuture.com/reference/analyst-note-lookup.md): Retrieve a specific analyst note by its ID with configurable serialization level.
- [Analyst Notes: Attachment](https://docs.recordedfuture.com/reference/analyst-note-attachment.md): Download the binary attachment file associated with an analyst note.
- [Analyst Notes: Export](https://docs.recordedfuture.com/reference/analyst-note-export.md): Export an analyst note as a rendered PDF or HTML file.
- [Analyst Notes: Draft](https://docs.recordedfuture.com/reference/analyst-note-draft.md): Create a draft analyst note in the database without publishing it.
- [Analyst Notes: Preview](https://docs.recordedfuture.com/reference/analyst-note-preview.md): Preview a rendered analyst note with entity resolution without saving it.
- [Analyst Notes: Publish](https://docs.recordedfuture.com/reference/analyst-note-publish.md): Publish an analyst note, making it visible to your organization.
- [Analyst Notes: Delete](https://docs.recordedfuture.com/reference/analyst-note-delete.md): Permanently delete an analyst note owned by your organization.
- [ASI Projects: List](https://docs.recordedfuture.com/reference/project-list.md): List all accessible ASI projects and their IDs.
- [ASI Assets: Search](https://docs.recordedfuture.com/reference/assets-search.md): Perform advanced compound asset queries using structured JSON filters with AND logic.
- [ASI Assets: Find](https://docs.recordedfuture.com/reference/assets-find.md): List and filter project assets using query-parameter-based criteria with OR logic.
- [ASI Assets: Read](https://docs.recordedfuture.com/reference/assets-read.md): Retrieve the full risk profile for a single asset with optional enrichment fields.
- [ASI Assets: List Exposures](https://docs.recordedfuture.com/reference/assets-list-exposures.md): Retrieve all exposures for a specific asset with CVE/CWE identifiers, severity, and remediation steps.
- [ASI Assets: Get Filters](https://docs.recordedfuture.com/reference/assets-get-filters.md): Discover available filter facets and their values across all project assets.
- [ASI Assets: Apply Tag](https://docs.recordedfuture.com/reference/assets-apply-tag.md): Apply a custom tag to an asset, auto-creating the tag if needed.
- [ASI Assets: Remove Tag](https://docs.recordedfuture.com/reference/assets-remove-tag.md): Remove a custom tag from an asset idempotently without deleting the tag definition.
- [ASI Assets: Bulk Add/Remove Tags](https://docs.recordedfuture.com/reference/assets-bulk-tag.md): Add and remove multiple custom tags on a single asset atomically in one request.
- [ASI Assets: Get Filtered Filters](https://docs.recordedfuture.com/reference/assets-get-filtered-filters.md): Retrieve filter facets narrowed to a specific asset subset using structured search filters.
- [ASI Tagging: Get Tags](https://docs.recordedfuture.com/reference/tagging-get-tags.md): Retrieve all custom tags defined for a project, including unused tags.
- [ASI Tagging: Get Task Status](https://docs.recordedfuture.com/reference/tagging-get-task-status.md): Poll the completion status of an asynchronous tagging operation by task ID.
- [ASI Tagging: Bulk Tag Assets](https://docs.recordedfuture.com/reference/tagging-bulk-tag-assets.md): Add and remove tags across multiple assets in a single request with per-asset control.
- [ASI Tagging: Add Tag](https://docs.recordedfuture.com/reference/tagging-add-tag.md): Create a custom tag at the project level, idempotently returning the tag if it already exists.
- [ASI Exposures: List](https://docs.recordedfuture.com/reference/exposures-list.md): Retrieve a deduplicated, project-wide list of exposure signatures with affected-asset counts.
- [ASI Exposures: Get Assets](https://docs.recordedfuture.com/reference/exposures-get-assets.md): List all assets affected by a specific exposure signature with per-asset extracted evidence.
- [ASI Rules: Get Static Assets](https://docs.recordedfuture.com/reference/rules-get-static-assets.md): List the manually defined scope rules (included/excluded hostnames, IPs, wildcards) for a project.
- [ASI Rules: Add Static Assets](https://docs.recordedfuture.com/reference/rules-add-static-assets.md): Bulk add or remove up to 1,000 static asset scope rules in a single asynchronous request.
- [Get Sources](https://docs.recordedfuture.com/reference/sources-list.md): List all custom intelligence sources in your account.
- [Create Source](https://docs.recordedfuture.com/reference/sources-create.md): Register a new custom intelligence source as a container for publishing threat reports.
- [Get Source](https://docs.recordedfuture.com/reference/sources-get.md): Retrieve metadata for a specific custom intelligence source.
- [Update Source](https://docs.recordedfuture.com/reference/sources-update.md): Modify the name or description of an existing custom intelligence source.
- [Publish Reports](https://docs.recordedfuture.com/reference/sources-publish-reports.md): Submit threat intelligence reports with observables, TTPs, and threat actor associations to a custom source.
- [Get Pending Jobs](https://docs.recordedfuture.com/reference/threat-hunting-jobs-pending.md): Poll for threat hunt jobs awaiting execution by an integration.
- [Get Job Indicators](https://docs.recordedfuture.com/reference/threat-hunting-job-indicators.md): Fetch threat indicators from a completed hunt job, optionally enriched with risk scores.
- [Get Job Detection Rules](https://docs.recordedfuture.com/reference/threat-hunting-job-rules.md): Fetch detection rules from a threat hunt job scoped to its time window.
- [Update Job Status](https://docs.recordedfuture.com/reference/threat-hunting-job-status.md): Transition a threat hunt job through its lifecycle (started, completed, failed) with optional outcome details.
- [Query Profiles](https://docs.recordedfuture.com/reference/threat-hunting-profiles-query.md): Discover threat hunting profiles configured for your organization with schedules and lookback windows.
- [Query Profiles](https://docs.recordedfuture.com/reference/threat-detection-profiles-query.md): Discover threat detection profiles with continuously-updated indicators and detection rules.
- [Get Profile Indicators](https://docs.recordedfuture.com/reference/threat-detection-profile-indicators.md): Fetch continuously-updated threat indicators from a detection profile with optional risk score enrichment.
- [Get Profile Detection Rules](https://docs.recordedfuture.com/reference/threat-detection-profile-rules.md): Fetch deployable detection rules (Sigma, Snort, YARA) from a detection profile.
- [Query Profiles](https://docs.recordedfuture.com/reference/threat-prevention-profiles-query.md): Discover threat prevention profiles with curated block lists of confirmed-malicious indicators.
- [Get Profile Indicators](https://docs.recordedfuture.com/reference/threat-prevention-profile-indicators.md): Fetch the block list of confirmed-malicious indicators from a prevention profile.
- [Get Profile Detection Rules](https://docs.recordedfuture.com/reference/threat-prevention-profile-rules.md): Fetch supplementary detection rules from a prevention profile tagged with MITRE ATT&CK techniques.
- [Collective Insights: Overview](https://docs.recordedfuture.com/reference/collective-insights.md)
- [Submit detected IOCs to the Collective Insights](https://docs.recordedfuture.com/reference/collective-insights-submit-detections.md): Ingest IoC detections from your security tools into Collective Insights to enrich your enterprise's threat intelligence with detection context from firewalls, SIEMs, and other sources.
- [Search Collective Insights events](https://docs.recordedfuture.com/reference/collective-insights-search.md): Query your organization's enriched detection history across all Collective Insights sources, filtered by indicator type, associated threats, detection method, and time range.
- [Search Detection Rules](https://docs.recordedfuture.com/reference/detection-rules-search.md): Search Insikt Group detection rules with deployable YARA, Sigma, and Snort source code.
- [Associated Entities](https://docs.recordedfuture.com/reference/detection-rules-associated-entities.md): List all entities linked to at least one detection rule, usable as search filters.
- [Associated Entity Types](https://docs.recordedfuture.com/reference/detection-rules-associated-entity-types.md): List entity type categories that appear across Insikt Group detection rules.
- [Enrichment: Field Attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes.md)
- [Search for Company entities based on a filter](https://docs.recordedfuture.com/reference/company-search.md): Find companies by name, risk score, industry, or risk rules with paginated risk assessment results.
- [Lookup a Company entity by id](https://docs.recordedfuture.com/reference/company-lookup.md): Get full company enrichment including risk scoring, triggered-rule evidence, analyst notes, and relationships.
- [Lookup Company by domain](https://docs.recordedfuture.com/reference/company-lookup-by-domain.md): Resolve a domain to its associated company entity with risk scoring and threat intelligence enrichment.
- [List Company risk rules.](https://docs.recordedfuture.com/reference/company-risk-rules.md): Get the catalog of company risk rules with criticality levels, entity counts, and NIST CSF codes.
- [Search for Domain entities based on a filter](https://docs.recordedfuture.com/reference/domain-search.md): Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results.
- [Lookup a Domain entity by id](https://docs.recordedfuture.com/reference/domain-lookup.md): Get full domain enrichment including risk scoring, AI insights, and relationships to threat actors and attack infrastructure.
- [List Domain risk rules](https://docs.recordedfuture.com/reference/domain-risk-rules.md): Get the catalog of ~78 domain risk rules with criticality levels, entity counts, and MITRE ATT&CK codes.
- [Fetch Domain risk list](https://docs.recordedfuture.com/reference/domain-risk-list.md): Download domains filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration.
- [Stat a domain risk list](https://docs.recordedfuture.com/reference/domain-stat-risk-list.md): Check domain risk list for changes via ETag headers without downloading the full file.
- [Lookup a Domain entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/domain-lookup-extension.md): Get third-party enrichment for a domain from extensions like SecurityTrails, VirusTotal, or Shodan.
- [Fetch Domain risk list demo events](https://docs.recordedfuture.com/reference/domain-demo-events.md): Get simulated Squid proxy logs with risky domains for testing SIEM integrations, refreshed every four hours.
- [Search for Hash entities based on a filter](https://docs.recordedfuture.com/reference/hash-search.md): Find file hashes by risk score, risk rules, algorithm type, or dates with paginated enrichment results.
- [Lookup a Hash entity by id](https://docs.recordedfuture.com/reference/hash-lookup.md): Get full hash enrichment including risk scoring, malware family attribution, and MITRE ATT&CK mappings.
- [List Hash risk rules](https://docs.recordedfuture.com/reference/hash-risk-rules.md): Get the catalog of hash risk rules with criticality levels, entity counts, and malware-focused MITRE ATT&CK codes.
- [Fetch Hash risk list](https://docs.recordedfuture.com/reference/hash-risk-list.md): Download file hashes filtered by risk rule in CSV/Splunk or STIX format for SIEM and EDR integration.
- [Stat a hash risk list](https://docs.recordedfuture.com/reference/hash-stat-risk-list.md): Check hash risk list for changes via ETag headers without downloading the full file.
- [Lookup a Hash entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/hash-lookup-extension.md): Get third-party enrichment for a hash from extensions like PolySwarm, VirusTotal, or ReversingLabs.
- [Fetch Hash risk list demo events](https://docs.recordedfuture.com/reference/hash-demo-events.md): Get simulated Symantec EP logs with risky file hashes for testing SIEM/EDR integrations, refreshed every four hours.
- [Search for IP Address entities based on a filter](https://docs.recordedfuture.com/reference/ip-search.md): Find IP addresses by risk score, threat rules, dates, or geolocation with paginated enrichment results.
- [Lookup a IP Address entity by id](https://docs.recordedfuture.com/reference/ip-lookup.md): Get full IP enrichment including risk scoring, geolocation, DNS, open ports, and threat actor relationships.
- [List IP Address risk rules](https://docs.recordedfuture.com/reference/ip-risk-rules.md): Get the catalog of ~90 IP risk rules with criticality levels, entity counts, and MITRE ATT&CK codes.
- [Fetch IP Address risk list](https://docs.recordedfuture.com/reference/ip-risk-list.md): Download IP addresses filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration.
- [Stat a IP Address risk list](https://docs.recordedfuture.com/reference/ip-stat-risk-list.md): Check IP address risk list for changes via ETag headers without downloading the full file.
- [Lookup a IP Address entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/ip-lookup-extension.md): Get third-party enrichment for an IP from extensions like Shodan, GreyNoise, Censys, or VirusTotal.
- [Fetch IP Address risk list demo events](https://docs.recordedfuture.com/reference/ip-demo-events.md): Get simulated Juniper NetScreen syslogs with risky IPs for testing SIEM integrations, refreshed every four hours.
- [Search for Malware entities based on a filter](https://docs.recordedfuture.com/reference/malware-search.md): Find malware families and tools by name or filter criteria; malware entities do not have risk scores.
- [Lookup a Malware entity by id](https://docs.recordedfuture.com/reference/malware-lookup.md): Get full malware enrichment including classification, MITRE ATT&CK mappings, and threat actor associations.
- [Lookup a Malware entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/malware-lookup-extension.md): Get third-party enrichment for a malware entity from Intelligence Card extensions.
- [Search for URL entities based on a filter](https://docs.recordedfuture.com/reference/url-search.md): Find URLs by risk score, risk rules, or date ranges with paginated enrichment results.
- [Lookup a URL entity by id](https://docs.recordedfuture.com/reference/url-lookup.md): Get full URL enrichment including risk scoring, AI threat analysis, and malware family relationships.
- [List URL risk rules](https://docs.recordedfuture.com/reference/url-risk-rules.md): Get the catalog of ~40 URL risk rules with criticality levels, entity counts, and MITRE ATT&CK codes.
- [Fetch URL risk list](https://docs.recordedfuture.com/reference/url-risk-list.md): Download URLs filtered by risk rule in CSV/Splunk or STIX format for SIEM and web proxy integration.
- [Stat a URL risk list](https://docs.recordedfuture.com/reference/url-stat-risk-list.md): Check URL risk list for changes via ETag headers without downloading the full file.
- [Lookup a URL entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/url-lookup-extension.md): Get third-party enrichment for a URL from extensions like VirusTotal, Kaspersky, or Mandiant.
- [Fetch URL risk list demo events](https://docs.recordedfuture.com/reference/url-demo-events.md): Get simulated Squid proxy logs with risky URLs for testing SIEM integrations, refreshed every four hours.
- [Search for Vulnerability entities based on a filter](https://docs.recordedfuture.com/reference/vulnerability-search.md): Find vulnerabilities by CVSS score, risk score, exploitation status, or affected product for patch prioritization.
- [Lookup a Vulnerability entity by id](https://docs.recordedfuture.com/reference/vulnerability-lookup.md): Get full CVE enrichment including severity, exploitation status, and threat actor and malware linkages.
- [List Vulnerability risk rules](https://docs.recordedfuture.com/reference/vulnerability-risk-rules.md): Get the catalog of vulnerability risk rules with criticality levels, entity counts, and exploitation-focused MITRE ATT&CK codes.
- [Fetch Vulnerability risk list](https://docs.recordedfuture.com/reference/vulnerability-risk-list.md): Download CVEs filtered by risk rule in CSV or STIX format for vulnerability management and patching.
- [Stat a Vulnerability risk list](https://docs.recordedfuture.com/reference/vulnerability-stat-risk-list.md): Check vulnerability risk list for changes via ETag headers without downloading the full file.
- [Lookup a Vulnerability entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/vulnerability-lookup-extension.md): Get third-party enrichment for a vulnerability from extensions like EPSS, ReversingLabs, or AlienVault.
- [Fetch Vulnerability risk list demo events](https://docs.recordedfuture.com/reference/vulnerability-demo-events.md): Get simulated vulnerability scan findings in NDJSON format for testing parsing logic, refreshed every four hours.
- [Match](https://docs.recordedfuture.com/reference/entity-match.md): Resolve human-readable entity names to Recorded Future entity IDs using fuzzy matching, with an optional type filter to narrow results to specific entity categories.
- [Lookup](https://docs.recordedfuture.com/reference/entity-lookup.md): Resolve an RF entity ID to its name, type, and aliases.
- [Available Entity Types](https://docs.recordedfuture.com/reference/available-entity-types.md): A categorized reference of all available entity types in the Recorded Future data. Type values are case sensitive and subject to change.
- [Fetch a feed file](https://docs.recordedfuture.com/reference/fusion-files-get.md): Download a file from the Fusion file system by path, including Fusion flow outputs and public Recorded Future-managed files.
- [Upload a feed file](https://docs.recordedfuture.com/reference/fusion-files-upload.md): Upload a file to your organization's Fusion file system, making it available for Fusion flows or retrieval via the download endpoint.
- [Delete a feed file](https://docs.recordedfuture.com/reference/fusion-files-delete.md): Remove a file from your organization's Fusion file system by path (public Recorded Future-managed files cannot be deleted).
- [Fetch the content of a directory](https://docs.recordedfuture.com/reference/fusion-files-list-directory.md): List files and subdirectories in a Fusion file system directory to discover available outputs before downloading.
- [Stat a feed file](https://docs.recordedfuture.com/reference/fusion-files-stat.md): Check file metadata (ETag, Last-Modified) without downloading content, enabling efficient polling for changes before a full download.
- [Detections](https://docs.recordedfuture.com/reference/identity-detections.md): Retrieve identity exposure detections with novel-only filtering and malware family attribution.
- [Search](https://docs.recordedfuture.com/reference/identity-search.md): Find compromised identities across breach data and stealer logs for one or more domains.
- [Lookup](https://docs.recordedfuture.com/reference/identity-lookup.md): Retrieve full exposure history for specific email addresses, usernames, or credential hashes.
- [Lookup passwords for exposure](https://docs.recordedfuture.com/reference/identity-password.md): Checks if specified passwords were exposed.
- [Hostname Lookup](https://docs.recordedfuture.com/reference/identity-hostname.md): Find credentials compromised from a specific hostname (e.g., internal servers, VPN endpoints).
- [IP Lookup](https://docs.recordedfuture.com/reference/identity-ip.md): Find credentials compromised from a specific IP address or IP range.
- [Incident Report](https://docs.recordedfuture.com/reference/identity-incident-report.md): Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution.
- [Dump Metadata Search](https://docs.recordedfuture.com/reference/identity-dump-metadata.md): Search metadata for data dumps and breach databases by name.
- [Search](https://docs.recordedfuture.com/reference/links-search.md): Search validated relationships between entities in the Links graph with category and type filters.
- [Metadata: Events](https://docs.recordedfuture.com/reference/links-metadata-events.md): List the analysis event types used to classify link sources in the Links graph.
- [Metadata: Entities](https://docs.recordedfuture.com/reference/links-metadata-entities.md): List entity types that can appear in the Links graph for use as search filters.
- [Metadata: Sections](https://docs.recordedfuture.com/reference/links-metadata-sections.md): List the link category sections used to classify relationships in the Links graph.
- [Lists: Supported Entities](https://docs.recordedfuture.com/reference/lists-supported-entities.md)
- [/list/create](https://docs.recordedfuture.com/reference/lists-create.md): Creates a new empty list and returns its metadata including the list ID.
- [/list/search](https://docs.recordedfuture.com/reference/lists-search.md): Searches for lists matching optional name, type, and limit filters.
- [/list/{listId}/info](https://docs.recordedfuture.com/reference/lists-info.md): Returns metadata for a specific list including name, type, timestamps, and ownership details.
- [/list/{listId}/status](https://docs.recordedfuture.com/reference/lists-status.md): Returns the processing status and entity count for a specific list.
- [/list/{listId}/entities](https://docs.recordedfuture.com/reference/lists-entities.md): Returns all entities in the specified list as a JSON array with no pagination.
- [/list/{listId}/entity/add](https://docs.recordedfuture.com/reference/lists-add-entity.md): Adds a single entity to the specified list, optionally with context metadata.
- [/list/{listId}/entity/remove](https://docs.recordedfuture.com/reference/lists-remove-entity.md): Removes a single entity from the specified list.
- [/list/{listId}/textEntries](https://docs.recordedfuture.com/reference/lists-text-entries.md): Returns unstructured text entries stored in the specified list as a JSON array.
- [/list/{listId}/entitiesWithTags](https://docs.recordedfuture.com/reference/lists-entities-with-tags.md): Returns all entities in the specified list along with their assigned tags.
- [/list/{listId}/entity/tags](https://docs.recordedfuture.com/reference/lists-replace-entity-tags.md): Replaces all tags on an entity in a Third-Parties Watch List.
- [Lists: Available Tags](https://docs.recordedfuture.com/reference/lists-available-tags.md)
- [Query Malware Intelligence data with query language](https://docs.recordedfuture.com/reference/malware-intelligence-query.md): Find and aggregate sandbox artifacts using structured query language.
- [Query Malware Intelligence data with natural language](https://docs.recordedfuture.com/reference/malware-intelligence-query-nl.md): Find sandbox artifacts using plain English instead of structured query syntax.
- [Query Malware Intelligence data with lists of entities](https://docs.recordedfuture.com/reference/malware-intelligence-query-iocs.md): Find sandbox artifacts by matching against lists of known IOCs instead of query expressions.
- [Fetch sandbox reports for a given sha256 hash and query](https://docs.recordedfuture.com/reference/malware-intelligence-sandbox-reports.md): Retrieve detailed behavioral and static analysis reports for a specific sample, ranked by sandbox score.
- [Create an Auto YARA job](https://docs.recordedfuture.com/reference/yara-create-job.md): Generate YARA detection rules by analyzing common byte patterns across malware samples.
- [Get all jobs created by user](https://docs.recordedfuture.com/reference/yara-list-jobs.md): List all Auto YARA jobs with status and coverage data, excluding rule text.
- [Edit an Auto YARA job](https://docs.recordedfuture.com/reference/yara-edit-job.md): Update the generated YARA rule on an existing job with revised detection logic.
- [Get result of a job](https://docs.recordedfuture.com/reference/yara-get-job.md): Retrieve a completed Auto YARA job's generated rule, byte patterns, and sample coverage analysis.
- [Delete a Job](https://docs.recordedfuture.com/reference/yara-delete-job.md): Permanently delete an Auto YARA job and its generated rules.
- [Retry a Job](https://docs.recordedfuture.com/reference/yara-retry-job.md): Reprocess a failed Auto YARA job without creating a new one.
- [Create a Auto Sigma job](https://docs.recordedfuture.com/reference/sigma-create-job.md): Generate Sigma detection rules from observed behavioral patterns across malware samples.
- [Get all jobs created by user](https://docs.recordedfuture.com/reference/sigma-list-jobs.md): List all Auto Sigma jobs with status and pagination support.
- [Get result of a job](https://docs.recordedfuture.com/reference/sigma-get-job.md): Retrieve a specific Auto Sigma job's status, configuration, and generated detection rules.
- [Delete a Job](https://docs.recordedfuture.com/reference/sigma-delete-job.md): Permanently delete an Auto Sigma job and its generated rules.
- [Update a Sigma Rule](https://docs.recordedfuture.com/reference/sigma-update-job.md): Classify a Sigma rule's detection quality and optionally update its YAML content.
- [Retry a Job](https://docs.recordedfuture.com/reference/sigma-retry-job.md): Reprocess a failed Auto Sigma job without creating a new one.
- [Get resulted file for the task](https://docs.recordedfuture.com/reference/pfi-pickup-data.md): Download the completed results of a PFI bulk data task in NDJSON or CSV format.
- [Create task to prepare bank account images for download.](https://docs.recordedfuture.com/reference/pfi-bank-account-images.md): Queue bank account document images for download by record IDs.
- [Create task to prepare checks images for download.](https://docs.recordedfuture.com/reference/pfi-check-images.md): Queue check document images for download by record IDs.
- [Adds new domains to the customer specific scanning queue](https://docs.recordedfuture.com/reference/pfi-add-scan-domains.md): Submit up to 10,000 domains to your organization's custom Magecart e-skimmer scanning queue.
- [Empties the customer specific scanning queue](https://docs.recordedfuture.com/reference/pfi-clear-scan-queue.md): Remove all domains from your organization's custom Magecart scanning queue.
- [Generate and run new a pipeline from bank account preset input](https://docs.recordedfuture.com/reference/pfi-bank-account-data.md): Queue a bulk export of compromised bank account records scoped to your organization.
- [Generate and run new a pipeline from full card preset input](https://docs.recordedfuture.com/reference/pfi-full-card-data.md): Queue a bulk export of compromised full payment card records scoped to your organization.
- [Generate and run new a pipeline from partial card input](https://docs.recordedfuture.com/reference/pfi-partial-card-data.md): Queue a bulk export of compromised partial card records with BIN-level data from e-skimmer activity.
- [Generate and run new a pipeline from partial card sold input](https://docs.recordedfuture.com/reference/pfi-sold-partial-card-data.md): Queue a bulk export of partial card records filtered by sold date rather than first-observed date.
- [Generate and run new a pipeline from bank check preset input](https://docs.recordedfuture.com/reference/pfi-check-data.md): Queue a bulk export of compromised bank check records for your organization.
- [Generate and run new a pipeline from CPP preset input](https://docs.recordedfuture.com/reference/pfi-cpp-merchant-data.md): Queue a bulk export of Common Point of Purchase (CPP) merchant records identifying potential points-of-compromise.
- [Generate and run new a pipeline from magecart domain input](https://docs.recordedfuture.com/reference/pfi-magecart-domain-data.md): Queue a bulk export of Magecart domain records tracking detected JavaScript card-skimming activity.
- [Generate and run new a pipeline from magecart merchant input](https://docs.recordedfuture.com/reference/pfi-magecart-merchant-data.md): Queue a bulk export of merchant-level Magecart records enriched with merchant name and MID.
- [Generate and run new a pipeline from magescanner scans input](https://docs.recordedfuture.com/reference/pfi-magescanner-scan-data.md): Queue a bulk export of Magescanner scan results for e-commerce card-skimming threat visibility.
- [Generate and run new a pipeline from checker preset input](https://docs.recordedfuture.com/reference/pfi-tester-merchant-data.md): Queue a bulk export of tester merchant records used by fraudsters to validate stolen cards.
- [Get tasks in queue](https://docs.recordedfuture.com/reference/pfi-list-tasks.md): Retrieve all PFI bulk data tasks in the queue, most recent first.
- [Get task status](https://docs.recordedfuture.com/reference/pfi-delete-task.md): Remove a queued PFI bulk data task before it starts executing.
- [Get task status](https://docs.recordedfuture.com/reference/pfi-task-status.md): Poll the processing status of a PFI bulk data task to determine when results are ready.
- [Get a single active risk rule with enriched evidence](https://docs.recordedfuture.com/reference/risk-get-active-risk-rule.md): Fetch a single active risk rule for a company with paginated, rule-type-specific enriched evidence (open ports, leaked credentials, vulnerable products).
- [Search for risk history](https://docs.recordedfuture.com/reference/risk-search-risk-history.md): Returns change events (not daily snapshots) for the risk score, criticality, and individual risk rules of one or more entities, so you can see when each value became active and when it was replaced.
- [List geolocations](https://docs.recordedfuture.com/reference/sandbox-list-geolocations.md): List available VPN exit points and regional tags for geographic routing in sandbox analysis.
- [List resources](https://docs.recordedfuture.com/reference/sandbox-list-resources.md): List available sandbox VM images, platforms, and capacity limits for profile creation.
- [List profiles](https://docs.recordedfuture.com/reference/sandbox-list-profiles.md): List all reusable analysis profiles configured for your organization.
- [Create profile](https://docs.recordedfuture.com/reference/sandbox-create-profile.md): Create a reusable sandbox analysis profile defining OS, locale, network, timeout, and browser settings.
- [Get profile](https://docs.recordedfuture.com/reference/sandbox-get-profile.md): Retrieve a single analysis profile by UUID or name.
- [Update profile](https://docs.recordedfuture.com/reference/sandbox-update-profile.md): Fully replace an existing analysis profile configuration (omitted optional fields reset to defaults).
- [Delete profile](https://docs.recordedfuture.com/reference/sandbox-delete-profile.md): Permanently remove an analysis profile without affecting previously analyzed samples.
- [List samples](https://docs.recordedfuture.com/reference/sandbox-list-samples.md): List sandbox samples in reverse chronological order with optional ownership filtering.
- [Submit a sample](https://docs.recordedfuture.com/reference/sandbox-submit-sample.md): Submit a file or URL for sandbox malware analysis via upload, fetch, or import modes.
- [Get sample details](https://docs.recordedfuture.com/reference/sandbox-get-sample.md): Retrieve a sample's analysis tasks and current processing status.
- [Search samples](https://docs.recordedfuture.com/reference/sandbox-search.md): Search sandbox analyses by hash, malware family, tag, or network indicator.
- [Delete a sample](https://docs.recordedfuture.com/reference/sandbox-delete-sample.md): Permanently delete a sample and all associated analysis data.
- [Set analysis profile](https://docs.recordedfuture.com/reference/sandbox-select-profile.md): Resume a paused interactive-mode submission by selecting analysis profiles for behavioral execution.
- [Stream all sample events](https://docs.recordedfuture.com/reference/sandbox-stream-all-events.md): Stream real-time NDJSON state-change events for all visible samples without replaying existing state.
- [Stream sample events](https://docs.recordedfuture.com/reference/sandbox-stream-sample-events.md): Stream a sample's current state and real-time updates, auto-closing when analysis reaches terminal status.
- [Get static analysis report](https://docs.recordedfuture.com/reference/sandbox-get-static-report.md): Retrieve the static analysis report with file metadata, hashes, PE structure, and YARA matches available before behavioral execution completes.
- [Get dynamic analysis report](https://docs.recordedfuture.com/reference/sandbox-get-dynamic-report.md): Retrieve the full behavioral analysis report with process trees, network flows, signatures, and malware configurations.
- [Get overview report](https://docs.recordedfuture.com/reference/sandbox-get-sample-overview.md): Retrieve the comprehensive overview report with malware config, signatures, IOCs, and MITRE ATT&CK mappings.
- [Get sample summary](https://docs.recordedfuture.com/reference/sandbox-get-sample-summary.md): Retrieve a mid-level analysis summary with per-task threat scores, behavior tags, and signature counts.
- [Get URL scan report](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-report.md): Retrieve the URL scan report with Chromium CDP data including HTTP requests, redirects, cookies, and certificates.
- [Get URL scan screenshot](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-screenshot.md): Retrieve the PNG screenshot captured during URL scan analysis.
- [Download original sample](https://docs.recordedfuture.com/reference/sandbox-download-sample.md): Download the originally submitted sample file as unencrypted binary.
- [Download sample archive (TAR)](https://docs.recordedfuture.com/reference/sandbox-download-archive-tar.md): Download all analysis artifacts for a completed sample as an uncompressed TAR archive.
- [Download sample archive (ZIP)](https://docs.recordedfuture.com/reference/sandbox-download-archive-zip.md): Download all analysis artifacts for a completed sample as a compressed ZIP archive.
- [Download task file](https://docs.recordedfuture.com/reference/sandbox-download-task-file.md): Download a specific file artifact dropped or extracted during behavioral execution.
- [Get behavioral logs](https://docs.recordedfuture.com/reference/sandbox-get-task-logs.md): Download raw kernel/system monitor logs capturing every process, file, registry, and network event from a behavioral task.
- [Download PCAP](https://docs.recordedfuture.com/reference/sandbox-download-pcap.md): Download the raw PCAP network capture from a behavioral task (unencrypted traffic only).
- [Download PCAPNG](https://docs.recordedfuture.com/reference/sandbox-download-pcapng.md): Download the PCAPNG network capture from a behavioral task, including decrypted HTTPS via embedded TLS key logs.
- [List YARA rules](https://docs.recordedfuture.com/reference/sandbox-list-yara-rules.md): List all custom YARA rule filenames accessible by your account.
- [Create YARA rule](https://docs.recordedfuture.com/reference/sandbox-create-yara-rule.md): Add a custom YARA rule compiled and validated server-side for automatic matching in future analyses.
- [Get YARA rule](https://docs.recordedfuture.com/reference/sandbox-get-yara-rule.md): Retrieve a YARA rule's source code, compilation status, and any warnings.
- [Update YARA rule](https://docs.recordedfuture.com/reference/sandbox-update-yara-rule.md): Update a YARA rule's source code and optionally rename it, with server-side recompilation.
- [Delete YARA rule](https://docs.recordedfuture.com/reference/sandbox-delete-yara-rule.md): Permanently remove a YARA rule while preserving existing match results.
- [Fetch risk information for a set of indicators](https://docs.recordedfuture.com/reference/soar-enrich.md): Retrieve risk scores, triggered rules, and evidence for up to 1,000 indicators across six entity types in a single batch call.
- [Lookup all available risk contexts](https://docs.recordedfuture.com/reference/soar-get-contexts.md): Retrieve configuration for the malware, phishing, and c2 risk contexts, including default thresholds used by the triage endpoint.
- [Triage multiple IOC entities](https://docs.recordedfuture.com/reference/soar-triage-batch.md): Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores.
- [STIX TAXII: Overview](https://docs.recordedfuture.com/reference/stix-taxii-overview.md)
- [STIX TAXII: 1.x Service](https://docs.recordedfuture.com/reference/stix-taxii-1x-service.md)
- [STIX TAXII: 2.1 Service](https://docs.recordedfuture.com/reference/stix-taxii-21-service.md)
- [STIX TAXII: Collections](https://docs.recordedfuture.com/reference/stix-taxii-collections.md)
- [Takedown API](https://docs.recordedfuture.com/reference/takedown-api.md): This is the API for requesting and monitoring takedowns. Provided by Phishfort
- [Available Threat Maps](https://docs.recordedfuture.com/reference/available-threat-maps.md): List all threat maps accessible to the current API token with their organization IDs and map types.
- [Threat Actor Threat Map](https://docs.recordedfuture.com/reference/threat-actor-threat-map.md): Rank threat actors by risk to your primary organization using intent and opportunity scores.
- [Threat Actor Threat Map for Organization](https://docs.recordedfuture.com/reference/threat-actor-threat-map-org.md): Rank threat actors by risk to a specific organization in a multi-org enterprise.
- [Threat Actor Search](https://docs.recordedfuture.com/reference/threat-actor-search.md): Search Recorded Future's threat actor database by name, alias, or classification.
- [Threat Actor Categories](https://docs.recordedfuture.com/reference/threat-actor-categories.md): Retrieve the full threat actor category taxonomy used across Recorded Future.
- [Malware Threat Map](https://docs.recordedfuture.com/reference/malware-threat-map.md): Rank malware families by prevalence and opportunity scores for your primary organization.
- [Malware Threat Map for Organization](https://docs.recordedfuture.com/reference/malware-threat-map-org.md): Rank malware families by prevalence and opportunity scores for a specific organization.
- [Malware Categories](https://docs.recordedfuture.com/reference/malware-categories.md): Retrieve the full malware classification taxonomy with valid category identifiers for filtering.
- [Gets Industry trends data given a TOE id](https://docs.recordedfuture.com/reference/customerapiswebv0industrytrendscontrollerindustry_trends.md): Gets Industry trends data given a TOE id
- [Portfolio member data including company description and domain ratings by security domain. If you are reading this and were filtering by analysis_id, please switch over to TOE_ID at your earliest convenience](https://docs.recordedfuture.com/reference/customerapiswebv0portfoliocontrollerportfolio_member_by_analysis_id.md): Portfolio member data including company description and domain ratings by security domain. If you are reading this and were filtering by analysis_id, please switch over to TOE_ID at your earliest convenience
- [query service by product and version, language and security_criteria using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerquery_with_language.md): query service by product and version, language and security_criteria using the query params
- [query threat_intel service by ip or host_name using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerthreat_intel_query.md): query threat_intel service by ip or host_name using the query params. Each is optional but one is required.
- [query vulnerabilities by product and version using the query param](https://docs.recordedfuture.com/reference/cpewebcpecontrollerquery.md): query vulnerabilities by product and version using the query param
- [query language and security_criteria using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerraw_language.md): query language and security_criteria using the query params
- [lookup product association with given cves](https://docs.recordedfuture.com/reference/cpewebcpecontrollercve_product_lookup.md): lookup product association with a given cves
- [This resource returns action plan configurations both automated and manual for a given TOE.](https://docs.recordedfuture.com/reference/getactionplanconfig.md): This API returns action plan configurations both automated and manual for a given TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.
- [This resource sends action plan email to recipients of a TOE.](https://docs.recordedfuture.com/reference/shareactionplan.md): This API sends action plan findings to internal and external recipients. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.  Recipients and frequency are optional. If recipients are not provided, the action plan will be shared with previously shared recipients. If frequency is not provided, the action plan will be shared manually.  Users can retrieve action plan configuration from ```(GET) /v1/action_plan/{toe_id} ``` API. * recipients: An Array of first_name, last_name, email, internal (true/false) for each recipient. See schema for more details. * frequency:  0 (default) is for manual/one-off, where 30/60/90 sets periodic automated action plan emails.
- [This resource returns a list of finding details from an action plan of a TOE.](https://docs.recordedfuture.com/reference/getactionplanfindings.md): This API returns a list of findings for a given action plan of a TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.
- [This resource tracks and reports a vendors progress in addressing action plan issues.](https://docs.recordedfuture.com/reference/actionplanissueprogress.md): RiskRecon automatically reports each vendor’s progress in addressing their action plan issues. This API returns issue progress for a given action plan.
- [This resource returns a vendor's action plan issue summary.](https://docs.recordedfuture.com/reference/getactionplanissuesummary.md): This API returns a list of issue summaries for a given action plan. There are no parameters for this use case. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.
- [This API returns the count of current action plan issues per their severity and priority.](https://docs.recordedfuture.com/reference/getactionplanprioritymatrix.md): This API returns the counts of action plans as per their severity and priority. Found issues are assigned a Priority and Severity index. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.  In this scenario, the following are returned in the response: * the asset value starting from 1 to 4, where 1 = Idle, 2 = Low, 3 = Medium, 4 = High * total count of issues for each asset value * total count of issues by severity. The severity values can be Low, Medium, High, and Critical.
- [This API returns the vendor status summary counts of a given action plan.](https://docs.recordedfuture.com/reference/getactionplanvendorstatussummarycounts.md): This API returns the vendor status summary counts of a given action plan. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.  In this scenario, the following are returned in the response:  * total action plans provided to the vendor * the label of the action plans * the status of the action plans
- [This resource returns Alerting Issues from new scans in their portfolio based on the users alert settings.](https://docs.recordedfuture.com/reference/getalertingnewissues.md): This resource returns Alerting Issues from new scans in their portfolio based on the users alert settings.  Alert settings can be changed at https://portal.riskrecon.com/portal/alert-center/alert-settings.
- [This resource returns any rating/score changes from new scans in the users portfolio based on the users alert settings.](https://docs.recordedfuture.com/reference/getalertingscorechanges.md): This resource returns any rating/score changes from new scans in the users portfolio based on the users alert settings. Alert settings can be changed at https://portal.riskrecon.com/portal/alert-center/alert-settings.
- [:: Legacy Route Please use getToeRatings :: This resource returns the most recent `Analysis` object by the TOE identifier. Trend data is only included if `include_trend` query param is added.](https://docs.recordedfuture.com/reference/getanalysisratings.md): :: Legacy Route Please use getToeRatings :: This resource returns the most recent `Analysis` object by the TOE identifier. This includes the security domain and criteria ratings. Trend data is only included if `include_trend` query param is added.
- [:: Legacy Route Please use getToeRatings :: This resource returns a collection of historical `Analysis` objects by the TOE identifier.](https://docs.recordedfuture.com/reference/gethistoricalanalysisratings.md): :: Legacy Route Please use getTOERatings :: This resource returns a collection of historical `Analysis` objects by the TOE identifier. This includes the security domain and criteria ratings for each analysis.
- [This resource returns an list of custom and industry standards.](https://docs.recordedfuture.com/reference/getriskstandards.md): This resource returns an list of custom and industry standards. Each standard has a number of controls.  Some of these will be mapped to RiskRecon security domain and criteria and will have the associated ratings.
- [This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.](https://docs.recordedfuture.com/reference/getriskstandardscontrols.md): This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.  The risk standard id can be obtained from the /v1/compliance/{toe_id} response. Some will be mapped to RiskRecon security domain and criteria so will include the ratings for these domain/criteria and the TOE being queried.
- [This resource returns a collection of `BreachEvent` objects.](https://docs.recordedfuture.com/reference/getbreachevents.md): This resource returns a collection of `DataLossEvent` objects for a portfolio. This is for the entire portfolio and has pagination unlike the data_loss_events route.
- [:: Legacy Route :: This resource returns a collection of `DataLossEvent` objects.](https://docs.recordedfuture.com/reference/getdatalossevents.md): "::Legacy Route please use portfolio_data_loss_events:: This resource returns a collection of `DataLossEvent` objects for a given TOE id. This are referred to as Breach Events in the RiskRecon site."
- [This resource returns a mapping of security_criteria labels and their current display names in the RiskRecon portal.](https://docs.recordedfuture.com/reference/getcriteriadisplaynames.md): This resource returns a mapping of security_criteria labels and their current display names in the RiskRecon portal.  It also includes if the security_criteria is currently rated and if it is deprecated.
- [This resource returns a mapping of security_domain labels and their current display names in the RiskRecon portal.](https://docs.recordedfuture.com/reference/getdomaindisplaynames.md): This resource returns a mapping of security_domain labels and their current display names in the RiskRecon portal.  It also includes if the security_domain is currently rated and if it is deprecated.
- [This resource returns a list of findings for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/getpaginatedfindings.md): This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API request. In this scenario, all findings for that TOE are returned in the response. To limit or filter the data returned in the response, you can use various parameters in the API request: * Filter by an asset value: You can use the asset_value parameter to search for findings with high, medium, or low asset value. * Filter by severity: You can use the severity parameter to search for findings with high, medium, or low severity. * Filter by asset value and severity: You can use asset_value and severity parameters to search for findings with high, medium, or low asset value and severity. * Filter by page: You can use the page parameter to search for findings pages. * Sort by Findings Attribute: You can use the sort attribute to sort results of alerting issues by available sort attributes.
- [:: Legacy Route :: This resource returns a list of findings for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/getfindings.md): ::Legacy Route please use findings_paginated:: This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API request. In this scenario, all findings for that TOE are returned in the response. To limit or filter the data returned in the response, you can use various parameters in the API request: * Filter by an asset value: You can use the asset_value parameter to search for findings with high, medium, or low asset value. * Filter by severity: You can use the severity parameter to search for findings with high, medium, or low severity. * Filter by asset value and severity: You can use asset_value and severity parameters to search for findings with high, medium, or low asset value and severity. * Filter by multiple asset values: You can use the asset_value parameter multiple times to search for findings with multiple asset values.
- [This resource returns a list of Hosts for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/gethosts.md): This resource returns a list of Hosts for latest analysis for a given TOE. This includes domain and netblock information as well.
- [The Integration Routes API provides a list of URLs for the security domains within the Security Profile section of the RiskRecon Portal.](https://docs.recordedfuture.com/reference/getintegrationroutes.md): The Integration Routes API provides a list of URLs for the security domains within the Security Profile section of the RiskRecon Portal. If one of the URLs is followed by an unauthenticated user, they will be prompted to authenticate before they are redirected to the requested URL. The only parameter for this API is the TOE ID, which is required.
- [The Integration Routes Details API provides a list of URLs for the detailed views within each security domain in the Security Profile and its corresponding risk_dimensions section of the RiskRecon Portal.](https://docs.recordedfuture.com/reference/getintegrationroutesdetails.md): The Integration Routes Details API provides a list of URLs for the detailed views within each security domain in the Security Profile and its corresponding risk_dimensions section of the RiskRecon Portal. API will also check if the customer has access and subscription enabled for requested risk dimensions and toes. The only parameter for this API is the TOE ID, which is required.
- [This endpoint is for requesting to add new TOEs (targets of evaluation) to your portfolio.](https://docs.recordedfuture.com/reference/bulktoerequest.md): This is a bulk request for requesting to add new TOEs (targets of evaluation) to your portfolio. The request must have at least one item but no more than 25 per request.
- [This endpoint adds and updates subscription licenses for a TOE.](https://docs.recordedfuture.com/reference/changesubscription.md): This request sets the list of subscription licenses that determine whether a TOE appears in your portfolio, and for which risk dimensions. The currently available Risk Dimensions are CYBER and PRIVACY. The available license types are AVISOR, DISCOVER, and SNAPSHOT. A cyber license of ADVISOR or DISCOVER is a prerequisite of any privacy license. SNAPSHOT licenses are not available for the privacy risk dimension at this time.
- [This resource gets the customer's risk relationship folders names and slugs.](https://docs.recordedfuture.com/reference/getriskrelationshipsfolders.md): This resource gets the customer's risk relationship folders names and slugs. The slug will be used in requests that require the risk relationship. Risk relationships can be updated here https://portal.riskrecon.com/portal/risk-configuration if you have necessary permissions.
- [This resource returns the default subscription_level for bulk toe requests for your customer.](https://docs.recordedfuture.com/reference/getsubscriptionlevelconfig.md): This resource returns the default subscription_level for bulk toe requests for your customer if it has been set.  This can be set if you want all /v1/portfolio/bulk_add requests to have the same subscription level.  Options are 1 (Discover) or 2 (Advisor)
- [This resource sets the default subscription_level for bulk toe requests for your customer.](https://docs.recordedfuture.com/reference/setsubscriptionlevelconfig.md): This resource sets the default subscription_level for bulk toe requests for your customer if it has been set.  This can be set if you want all /v1/portfolio/bulk_add requests to have the same subscription level.  Options are 1 (Discover) or 2 (Advisor)
- [This route returns a collection of `Subsidiary` objects associated with a toe.](https://docs.recordedfuture.com/reference/getsubsidiariesbytoeid.md): This route returns a collection of `Subsidiary` objects associated with a toe. Any TOEs that appear to be a subsidiary of the provided TOE id are returned in the response.
- [This resource returns a collection of `TOE` objects mapped to a customer.](https://docs.recordedfuture.com/reference/gettoes.md): This API retrieves a collection of TOE objects mapped to a customer. This include overall ratings and some domain rating information for the current analysis of the provided TOE id. As a TOE can have multiple internal IDs, this API filters if the internal ID is one among the multiple internal IDs.
- [This resource gets a `TOE` object by its identifier.](https://docs.recordedfuture.com/reference/gettoesbytoeid.md): This resource gets a `TOE` object by its identifier. This include overall ratings and some domain rating information for the current analysis of the provided TOE id.
- [This endpoint adds an existing TOE to the users portfolio.](https://docs.recordedfuture.com/reference/addcompanytotoebytoeid.md): This endpoint adds an existing TOE to the users portfolio. The toe_id and other information can be obtained from the /v1/toes/by_domains response.
- [This endpoint allows a user to update the internal_ids and/or internal_name of an existing `TOE` by its identifier.](https://docs.recordedfuture.com/reference/updatetoesbytoeid.md): This endpoint allows a user to update the internal_ids and/or internal_name of an existing `TOE` by its identifier. These can be used to map a TOE in the RiskRecon system to an entity in the users system.
- [This endpoint deletes an existing TOE to the users portfolio.](https://docs.recordedfuture.com/reference/deletetoebytoeid.md): User can delete a TOE from their portfolio by providing the toe_id in endpoint.
- [This resource returns a collection of `TOE` objects mapped to a customer.](https://docs.recordedfuture.com/reference/getpaginatedtoes.md): This API retrieves a collection of TOE objects mapped to a customer. This include overall ratings and some domain rating information for the current analysis of the provided TOE id. As a TOE can have multiple internal IDs, this API filters if the internal ID is one among the multiple internal IDs.
- [This endpoint allows the user to search for a TOE by a valid domain or hostname.](https://docs.recordedfuture.com/reference/gettoebydomain.md): This endpoint allows the user to search for a TOE by a valid domain or hostname. The user must provide a valid domain or hostname in domain query param.
- [This endpoint allows the user to search for Company name, TOE ID by a valid CVE.](https://docs.recordedfuture.com/reference/gettoebycve.md): This endpoint allows the user to search for Company name, TOE ID by a valid CVE. The user must provide a valid cve in query param.
- [Get the current or historical overall, domain and criteria ratings for a given TOE and a given risk dimension.](https://docs.recordedfuture.com/reference/gettoeratings.md): Get the current or historical overall, domain and criteria ratings for a given TOE and a given risk dimension. Privacy can only be returned if privacy is enabled for your customer and you have a privacy license for the given TOE.
- [This endpoint moves an existing TOE from one risk relationship folder to another](https://docs.recordedfuture.com/reference/movetoerequest.md): User can move a TOE from one risk relationship folder to another by providing the toe_id and relationship folder slug in request. Relationship folder slug can be retrieved from [/v1/portfolio/risk_relationships_folders](#/Portfolio/getRiskRelationshipsFolders).
- [The User route is used to get all the user data for one’s organization.](https://docs.recordedfuture.com/reference/getuserdata.md): The User route is used to get all the user data for one’s organization. There currently are no filters or params.
- [This resource allows the ordering and downloading of toe reports](https://docs.recordedfuture.com/reference/requestpdfreport.md): This endpoint provides the ordering of the following toe reports:   - Executive Report - The Executive Report (executive-report) provides an executive summary  of the RiskRecon ratings and security performance metrics.   - Summary Report - The RiskRecon Summary Report (summary-report) provides the summary  RiskRecon ratings and security performance metrics.   - Detailed Report - The RiskRecon Detailed Report (detailed-report) provides the RiskRecon  ratings, security performance metrics, and detailed findings and recommendations.   - Action Plan - The action plan (action-plan) on this toe.
- [This resource returns the list of active report request.](https://docs.recordedfuture.com/reference/requestpdfreportstatus.md): This resource returns all report requests submitted in the last 24 hours by the client.
- [This resource returns the PDF report.](https://docs.recordedfuture.com/reference/downloadpdfreport.md): This resource gets the PDF report.
- [Get portfolio ratings report](https://docs.recordedfuture.com/reference/getpaginatedportfolioratingsreport.md): Retrieves a paginated list of portfolio ratings with their changes over time
- [This resource returns a collection of `EnforcementAction` objects.](https://docs.recordedfuture.com/reference/getenforcementactions.md): This resource returns a collection of `EnforcementAction` in portfolio.
- [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE, security domain and security criteria. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerby_security_criteria.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE, security domain and security_criteria. Use include_all param to include all findings.  Unfortunately, swagger UI can't format the streamed response but the given curl example will execute.
- [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE and security domain. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerby_security_domain.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE and security domain. Use include_all param to include all findings.  Unfortunately, swagger UI can't format the streamed response but the given curl example will execute.
- [Retrieve finding given toe id and finding id](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollershow.md): Retrieve finding given toe id and finding id
- [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerindex.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE. Use include_all param to include all findings. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings.  Unfortunately, swagger UI can't format the streamed response but the given curl example will execute.

## Changelog
- [Playbook Alerts API v1.4.0](https://docs.recordedfuture.com/changelog/playbook-alerts-api-v140.md)
- [RiskRecon APIs](https://docs.recordedfuture.com/changelog/riskrecon-apis.md)
- [Playbook Alerts API v1.3.1](https://docs.recordedfuture.com/changelog/playbook-alerts-api-v131.md)
- [Malware Intelligence API v1.7.3](https://docs.recordedfuture.com/changelog/malware-intelligence-api-v173.md)
- [Playbook Alerts API v1.3.0](https://docs.recordedfuture.com/changelog/playbook-alerts-api-v130.md)
- [ASI Project API v1.7.0](https://docs.recordedfuture.com/changelog/asi-project-api-v170.md)
- [Malware Intelligence API v1.7.1](https://docs.recordedfuture.com/changelog/malware-intelligence-api-v171.md)
- [Playbook Alerts API v1.2.0](https://docs.recordedfuture.com/changelog/playbook-alerts-api-v120.md)
- [Malware Intelligence API v1.7.0](https://docs.recordedfuture.com/changelog/malware-intelligence-api-v170.md)
- [Risk API](https://docs.recordedfuture.com/changelog/risk-api.md)