What this endpoint does

This endpoint retrieves enrichment data for a specific file hash from a third-party Intelligence Card extension integrated into the Recorded Future platform. Each extension connects to a different threat intelligence provider such as PolySwarm, VirusTotal, ReversingLabs, CarbonBlack, or Mandiant, among 19 available sources. Most extensions require that your organization has pre-configured credentials for the corresponding third-party service within the Recorded Future platform; extensions like active_polyswarm work without additional configuration. Unlike the domain extension endpoint, hash extensions are particularly valuable for multi-engine malware scanning and file reputation lookups. Use the Hash Search or Hash Lookup endpoint to confirm the hash entity exists before querying extensions.

Response data

The response contains a data object whose structure varies entirely depending on which extension is queried. For example, the PolySwarm extension returns a reputation verdict (MALICIOUS/BENIGN), multi-engine detection ratio, file type identification, malware family names from individual engines, all hash algorithm variants (MD5, SHA1, SHA256, SHA512) as Recorded Future entity IDs, and a link to the full scan results. An optional metadata object provides explanatory annotations when requested.