Entity Types and ID Prefixes

ID prefixes

Many entity types have a predictable Recorded Future ID: a type prefix followed by the value itself. For these types you can build the ID directly and pass it to any endpoint that accepts an entity ID, such as Entity: Lookup, Lists: Add Entity, or the type-specific lookup endpoints. No Entity Match call is needed.

All other types, including Malware, CyberVulnerability, Company, Organization, Person, and Product, use opaque IDs (for example, AsyncRAT is Yzaz0L). Resolve these with Entity: Match. CVE strings such as CVE-2021-44228 are not valid entity IDs.

Entity types

These are the values accepted by the type filter on Entity: Match. The list changes as Recorded Future adds new entity types.

Case sensitivity. Type values and request field names (name, type, limit) are case sensitive. A wrong-case field name returns a 400 error that names the unrecognized parameter. A wrong-case type value, such as malware instead of Malware, returns an empty array with no error.