What this endpoint does

This endpoint resolves human-readable entity names to Recorded Future entity IDs using fuzzy name matching. It is the primary way to find entity IDs when you know a name (such as "Log4Shell", "AsyncRAT", or "8.8.8.8") but need the corresponding RF entity ID required by other API endpoints. The optional type filter narrows results to specific entity types — without it, results can span vulnerabilities, malware, IPs, usernames, products, and more. Use the returned entity IDs with the Entity: Lookup endpoint to retrieve identity metadata, with type-specific lookup endpoints (such as IP Address: Lookup or Vulnerability: Lookup) for full enrichment, or with the Detection Rules: Search endpoint's entities filter to find associated detection rules.

Response data

The response is a JSON array of matched entity objects, ranked by match quality (best match first). Each object contains id (the Recorded Future entity ID), name (the entity's display name, which may differ from the search term — for example, searching "Log4Shell" returns CVE-2021-44228), and type (the entity classification such as CyberVulnerability, Malware, IpAddress, or InternetDomainName). Results are capped at the limit value (default 10, maximum 100).

200Successful request - Returns a list of items or an empty list if no items were found.

400Bad request