What this endpoint does

This endpoint searches the Recorded Future Intelligence Cloud for file hash entities matching specified criteria. You can filter hashes by risk score ranges, specific risk rules (use the Hash Risk Rules endpoint for valid rule names), hash algorithm type (MD5, SHA-1, SHA-256, SHA-512, CRC-32, or CTPH), first/last seen dates, and Recorded Future list membership. The algorithm filter is hash-specific and useful when you need to find hashes of a particular type for compatibility with systems that only support certain algorithms. Results can be sorted by risk score, criticality, reference counts, or chronological fields.

Response data

The response contains a paginated array of matching hash entities, each populated with the requested enrichment fields, along with count metadata showing returned and total matching records. When risk data is requested, each hash includes a composite risk score, criticality level, and evidence details with sandbox verdicts, malware family detections, and source attribution. Paginated with offset-based pagination; limit max 1,000 and limit + from cannot exceed 1,000. Results are under data.results, with counts as a sibling of data. The limit parameter has a default value of 10. The intention is to use pagination to get further results. Though limit can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs.