What this endpoint does

This endpoint searches the Recorded Future Intelligence Cloud for domain entities matching specified criteria. You can filter domains by risk score ranges, specific risk rules (use the Domain Risk Rules endpoint to get valid rule names), first/last seen dates, and Recorded Future list membership. Results can be sorted by risk score, criticality, total or recent reference counts, or chronological fields, enabling prioritized views of the most dangerous or recently active domains. The enrichment fields system lets you control which data is returned per result, such as entity identifiers and risk scoring—consult the Enrichment Field Attributes reference for all available field options.

Response data

The response contains a paginated array of matching domain entities, each populated with the requested enrichment fields, along with count metadata showing the number of returned and total matching records. When risk data is requested, each domain includes a composite risk score (0-99), criticality level, and a breakdown of every triggered risk rule with supporting evidence—sighting counts, source descriptions, timestamps, and mitigation notes. Pagination supports up to 1,000 results per page with a maximum window of 10,000 total results accessible via the offset parameter.