What this endpoint does

This endpoint searches the Recorded Future Intelligence Cloud for file hash entities matching specified criteria. You can filter hashes by risk score ranges, specific risk rules (use the Hash Risk Rules endpoint for valid rule names), hash algorithm type (MD5, SHA-1, SHA-256, SHA-512, CRC-32, or CTPH), first/last seen dates, and Recorded Future list membership. The algorithm filter is hash-specific and useful when you need to find hashes of a particular type for compatibility with systems that only support certain algorithms. Results can be sorted by risk score, criticality, reference counts, or chronological fields.

Response data

The response contains a paginated array of matching hash entities, each populated with the requested enrichment fields, along with count metadata showing returned and total matching records. When risk data is requested, each hash includes a composite risk score, criticality level, and evidence details with sandbox verdicts, malware family detections, and source attribution. Pagination supports up to 1,000 results per page with a maximum window of 10,000 results via the offset parameter.