Core APIs

API	Included Modules
Alerts	All except SecOps Intelligence
Analyst Notes	All modules
Attack Surface Intelligence	Attack Surface Intelligence
Autonomous Threat Operations	Threat Intelligence or SecOps Intelligence, & Autonomous Threat Operations add-on
Collective Insights	SecOps Intelligence, Threat Intelligence
Detection Rules	SecOps Intelligence, Threat Intelligence
Entity Match	All modules
Fusion	Fusion access granted by Support as needed
Identity Intelligence	Identity Intelligence
Links	SecOps Intelligence, Threat Intelligence
Lists	All modules
Malware Intelligence	SecOps Intelligence, Threat Intelligence
Payment Fraud Intelligence	Payment Fraud Intelligence
Risk	All modules with the addition: Integration user - "Risk History Read API Access" enabled User privilege - RiskApiRead
Sandbox	SecOps Intelligence, Threat Intelligence
Takedowns	Brand Intelligence
Threat Maps	Threat Intelligence

Enrichment & Risk Lists

API	Included Modules
Company Enrichment	Third Party Intelligence
IP / Domain / URL Enrichment	SecOps Intelligence, Threat Intelligence, Brand Intelligence
Hash / File Enrichment	SecOps Intelligence, Threat Intelligence
IOC Risk Lists	SecOps Intelligence, Threat Intelligence
Malware Enrichment	SecOps Intelligence, Threat Intelligence
SOAR	SecOps Intelligence, Threat Intelligence
Vulnerability Enrichment	Vulnerability Intelligence
Vulnerability Risk Lists	Vulnerability Intelligence

Troubleshooting 403 Errors

A 403 Forbidden response from the Recorded Future API can indicate one of two distinct issues:

"Missing API privileges" — Your API token does not have the module entitlement required for the endpoint you are calling. Check the tables above to verify your module includes the API. If it does not, contact your Recorded Future account team to discuss adding the required module. If your module was recently added, you may need to regenerate your API token for the new entitlements to take effect.

"Missing Data permissions" — Your API token has the correct module entitlement, but your account lacks access to the specific data group referenced in the request. This is a data-scope restriction, not a licensing issue. Contact your Recorded Future administrator to review your data-group ACL configuration.

Read the error.message field in the JSON response to determine which type of 403 you received.