What this endpoint does

This endpoint retrieves threat intelligence references (sightings, reports, and citations) associated with a specific Company entity in the Recorded Future Intelligence Cloud. Results are segmented by risk category: use "exposedCredential" to find leaked credential reports, or "companyMention" to find general threat intelligence mentions of the company. You must first obtain a Company entity ID using either the Lookup Company by Domain endpoint or the Search Company endpoint. Results can be filtered by publication date, source, media type, and email address, and are paginated with a maximum window of 10,000 results.

Response data

The response contains a paginated list of reference objects representing individual intelligence sightings or reports that mention the company, along with count metadata showing the number of returned and total matching records. Each reference includes details about where and when the company was mentioned in the threat intelligence landscape, enabling analysis of exposed credentials, breach reports, and other security-relevant citations over time.