What this endpoint does

This endpoint resolves a domain name to its parent Company entity in the Recorded Future Intelligence Cloud, enabling domain-to-company attribution. Given a domain like "google.com", it returns the associated company profile along with requested enrichment fields such as risk scoring and threat intelligence. This is useful as an entry point when you know a domain but need the company's Recorded Future entity ID to perform further lookups. Use the returned entity ID with the Lookup Company by ID endpoint for full entity details, or with the List Company References endpoint to explore associated threat intelligence references.

Response data

The response contains the matched company entity with its unique identifier, display name, and entity type, along with any requested enrichment fields. When risk data is requested, the response includes a composite risk score (0-99), a criticality level, and a detailed breakdown of every triggered risk rule with supporting evidence. Risk rules span categories including reported cyber attacks, exposed credentials, infrastructure vulnerabilities, dark web market activity, typosquat domains, email security misconfigurations (SPF/DMARC), and technology stack vulnerabilities. Each evidence detail includes the rule name, criticality rating, sighting counts, timestamps, and where applicable, mitigation context.