What this endpoint does

This endpoint retrieves enrichment data for a specific domain from a third-party Intelligence Card extension integrated into the Recorded Future platform. Each extension connects to a different threat intelligence provider such as SecurityTrails, VirusTotal, Shodan, or DomainTools Iris, among over 20 available sources. Most extensions require that your organization has pre-configured credentials for the corresponding third-party service within the Recorded Future platform; without this, requests will return a credentials error. Use the Domain: Lookup endpoint to obtain the domain entity ID needed for this call.

Response data

The response contains a data object whose structure varies entirely depending on which extension is queried, since each provider returns different intelligence. For example, the SecurityTrails extension returns DNS infrastructure data including nameserver, MX, A, SOA, and TXT records with associated organizations, while the report_website extension returns links for submitting the domain to abuse-reporting services. An optional metadata object provides explanatory annotations about the response fields when requested.