For AI agents: visit https://docs.recordedfuture.com/llms.txt for an index of all pages formatted in Markdown and endpoints in OpenAPI. Append .md to any documentation page URL to get its markdown version.

API Documentation

Getting Started

Recorded Future API Overview
API Entitlements
LLM Instructions

Alerts

Classic Alerts
Search & Management
Domain Abuse
Malicious Sites
Vulnerability
- Detailed Vulnerability alert datapost
- Bulk Vulnerability alert lookuppost
Data Leakage on Code Repository
- Detailed Code Repository Data Leakage alert datapost
- Bulk Code Repository Data Leakage alert lookuppost
Third Party Risk
- Third Party Risk alert datapost
- Bulk Third Party Risk alert lookuppost
Identity Novel Exposures
- Detailed Identity Novel Exposures alert datapost
- Bulk Identity Novel Exposures alerts lookuppost
Geopolitics Facility
Malware Intelligence
- Malware Report alert notification data.post
- Bulk Malware Report alert lookuppost
Payment Card Fraud
Dark Web Brand
- Playbook Alerts: Dark Web Brand Detailpost
- Playbook Alerts: Dark Web Brand Bulkpost
Social Media Impersonation
- Playbook Alerts: Social Media Impersonation Detailpost
- Playbook Alerts: Social Media Impersonation Bulkpost
Cases

Analyst Notes

Configuration
Search & Lookup
Publishing

Attack Surface Intelligence

Project
- ASI Projects: Listget
Assets
Tagging
Exposures
- ASI Exposures: Listget
- ASI Exposures: Get Assetsget
Rules
- ASI Rules: Get Static Assetsget
- ASI Rules: Add Static Assetspost

Autonomous Threat Operations

Intelligence Sources
Threat Hunting
Threat Detection
Threat Prevention

Collective Insights

Collective Insights: Overview
Detections
- Submit detected IOCs to the Collective Insightspost
Search
- Search Collective Insights eventspost
Exclusions

Detection Rules

Search & Associations

Enrichment and Risk Lists

Enrichment: Field Attributes
Company
Domain
Hash
IP
Malware
URL
Vulnerability

Entity Match

Matching & Lookup

Fusion

File Operations
Directory & Metadata
- Fetch the content of a directoryget
- Stat a feed filehead

Identity Intelligence

Detections
- Detectionspost
Credentials

Links

Links
- Search for linkspost
Metadata

Lists

Lists: Supported Entities
List Management
Entity Operations
Third Parties Watch List Tags

Malware Intelligence

Queries and Reporting
Auto YARA
Auto Sigma

Payment Fraud Intelligence

Data Retrieval
- Get resulted file for the taskpost
Images
- Create task to prepare bank account images for download.put
- Create task to prepare checks images for download.put
Scanning Queue
- Adds new domains to the customer specific scanning queuepost
- Empties the customer specific scanning queuepost
Bulk Data Requests
Task Management

Risk

Company Risk Rules
- Get a single active risk rule with enriched evidencepost
Risk History
- Search for risk historypost

Sandbox

Environment
- List geolocationsget
- List resourcesget
Profiles
Submissions
Streaming
- Stream all sample eventsget
- Stream sample eventsget
Reports
Downloads
Task Artifacts
YARA Rules

SOAR

Enrichment & Triage

STIX TAXII Feeds

STIX TAXII: Overview

Takedowns

Takedown API

Threat Maps

All Maps
- Available Threat Mapsget
Actors Threat Map
Malware Threat Map

RiskRecon V0

IndustryTrends
- Gets Industry trends data given a TOE idget
Portfolio
- Portfolio member data including company description and domain ratings by security domain. If you are reading this and were filtering by analysis_id, please switch over to TOE_ID at your earliest convenienceget

RiskRecon CPE V0

CPE

RiskRecon V1

Action Plans
Alerts
- This resource returns Alerting Issues from new scans in their portfolio based on the users alert settings.get
- This resource returns any rating/score changes from new scans in the users portfolio based on the users alert settings.get
Analyses
- :: Legacy Route Please use getToeRatings :: This resource returns the most recent `Analysis` object by the TOE identifier. Trend data is only included if `include_trend` query param is added.get
- :: Legacy Route Please use getToeRatings :: This resource returns a collection of historical `Analysis` objects by the TOE identifier.get
Compliance
- This resource returns an list of custom and industry standards.get
- This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.get
Data Loss Events
- This resource returns a collection of `BreachEvent` objects.get
- :: Legacy Route :: This resource returns a collection of `DataLossEvent` objects.get
Display Name
- This resource returns a mapping of security_criteria labels and their current display names in the RiskRecon portal.get
- This resource returns a mapping of security_domain labels and their current display names in the RiskRecon portal.get
Findings
- This resource returns a list of findings for latest analysis for a given TOE.get
- :: Legacy Route :: This resource returns a list of findings for latest analysis for a given TOE.get
Hosts
- This resource returns a list of Hosts for latest analysis for a given TOE.get
Integration Routes
- The Integration Routes API provides a list of URLs for the security domains within the Security Profile section of the RiskRecon Portal.get
- The Integration Routes Details API provides a list of URLs for the detailed views within each security domain in the Security Profile and its corresponding risk_dimensions section of the RiskRecon Portal.get
Portfolio
Subsidiaries
- This route returns a collection of `Subsidiary` objects associated with a toe.get
Target Of Evaluation TOE
Users
- The User route is used to get all the user data for one’s organization.get
TOE Reports
Reports
- Get portfolio ratings reportget
Privacy
- This resource returns a collection of `EnforcementAction` objects.get

RiskRecon V2

Finding

Search & Metadata

Updated 5 days ago

Recorded Future API Overview

Did this page help you?

Updated 5 days ago

Recorded Future API Overview

Did this page help you?