Get full domain enrichment including risk scoring, AI insights, and relationships to threat actors and attack infrastructure.
What this endpoint does
This endpoint retrieves detailed intelligence about a specific domain from the Recorded Future Intelligence Cloud. The domain ID uses the format idn:domain.com and can be obtained from the Domain: Search endpoint. You control which intelligence is returned via the fields parameter—for most security workflows, use entity,risk,aiInsights,links,intelCard to get actionable intelligence at a compact response size (under 5KB). The links field is especially valuable as it contains technically validated relationships (threat actors, attack vectors, infrastructure connections) sourced from sandbox analysis and Insikt Group research, including structured Insikt Group analyst findings. Avoid requesting relatedEntities (co-occurrence associations, not validated linkages), analystNotes (very large and redundant with links which already surfaces Insikt Group research in structured form), metrics (flat counters that duplicate risk data), and counts (daily reference histograms). For deeper link investigation—such as filtering by source type, analysis method, or timeframe, querying multiple entities in batch, or getting per-entity risk scores on linked entities—use the dedicated Links: Search endpoint instead of the links enrichment field. Call GET /v2/domain/fields to list valid field names programmatically, or consult the Enrichment: Field Attributes reference.
Response data
The response contains a single domain entity populated with the requested enrichment fields. The risk field provides a composite score (0-99), criticality level (None through Very Malicious), and evidence details for each triggered rule. The aiInsights field returns a concise AI-generated natural-language summary ideal for quick triage. The links field organizes operationally actionable connections into sections like "Actors, Tools & TTPs" with source attribution, containing threat actor names, attack vectors, and related infrastructure discovered through technical analysis—this is where the most actionable intelligence lives, though in a nested format without per-entity risk scores; use the Links: Search endpoint when you need a flat structure with inline risk scores on each linked entity, or need to filter by section, source, timeframe, or event type. The intelCard field provides a direct URL to the domain's Intelligence Card in the Recorded Future UI, enabling human analysts to pivot for deeper investigation when needed.