This document routes you to the correct endpoint documentation based on the user's objective. It is NOT API documentation. Always fetch and read the endpoint .md files for parameters, schemas, and behavior.
doc_url_pattern: "https://docs.recordedfuture.com/reference/{slug}.md"
instructions:
- Ask the user their objective with the Recorded Future APIs and their preferred language (Python or PowerShell).
- Match their objective to a workflow below. Combine workflows if the objective spans multiple.
- Every step carries a slug. Fetch that step's documentation at https://docs.recordedfuture.com/reference/{slug}.md. Do not search an index to resolve endpoint names. Where a step lists several slugs, fetch the one matching the user's entity type or alert type.
- If you have code execution capabilities, download the .md files directly via HTTP (curl or requests) to avoid summarization by intermediate tools.
- Fetch the .md file for each step in the matched workflow, in order.
- If no workflow matches, fetch the complete API reference index at https://docs.recordedfuture.com/reference/llms.txt and pick endpoints from it. Per-category indexes exist at https://docs.recordedfuture.com/reference/{category}/llms.txt (category slugs are listed in https://docs.recordedfuture.com/llms.txt). The root llms.txt is only a map of those category files and does not list endpoints.
- Before taking action, ask the user whether they want (a) to explore the API capabilities and responses or (b) working code.
- If exploration — summarize what each relevant endpoint does, its parameters, and what it returns. Offer to dive deeper or pivot to code when ready.
- If code — present a data flow plan covering endpoints, auth, request/response flow, and execution order. Wait for approval before writing.
- In either case, state which base URL and auth header apply. These vary across API families — always read them from the securitySchemes and servers fields in each endpoint document.
mcp:
- "If your client supports MCP, you may also connect to https://docs.recordedfuture.com/mcp (streamable HTTP, no credentials needed to connect). Tools: list-specs, list-endpoints, search-endpoints, get-endpoint, get-server-variables, execute-request."
- "Use search-endpoints and get-endpoint to discover endpoints outside the workflows below and to read exact request/response schemas. Use execute-request to test a call. It forwards the headers configured in your MCP client, so put the API's auth header (for example X-RFToken) in that client config."
- "MCP serves the OpenAPI definitions only. The .md pages add usage guidance and gotchas that are not in the spec, so still fetch the .md page for each step you plan to code against."
also_read_guidance:
- "also_read entries are slugs and are NOT required reading. Do NOT fetch them upfront."
- "Only fetch an also_read page when the user's question or plan specifically requires information that the primary workflow steps did not cover."
- "When presenting a plan, mention relevant also_read endpoints as 'available if needed' so the user can request them."
error_handling:
- "If you cannot fetch llm-instructions.md, stop and tell the user: 'I was unable to load the Recorded Future API routing guide. This assistant requires web fetch capabilities to function. Please try a model or tool configuration that supports raw URL fetching.'"
- "If a specific endpoint .md file cannot be fetched, tell the user which resource failed and offer to proceed with what you have, or retry."
- "A request for a .md URL that does not exist returns a short markdown 404 that points back to llms.txt. If you see one, look the endpoint up in https://docs.recordedfuture.com/reference/llms.txt instead of guessing another URL."
- "If a fetched document appears summarized, truncated, or otherwise incomplete, inform the user and do not treat partial information as authoritative."
response_schema_guidance:
- Endpoint .md files define complete OpenAPI response schemas with nested properties, types, and descriptions. Trust the documented schema and use it to guide field access when writing code.
- When the user asks "can I get field X from endpoint Y?", answer based on the fetched schema. Only answer "no" if the documentation explicitly states that something is unsupported, deprecated, or restricted.
- If you encounter an endpoint where the schema appears underspecified (e.g., generic `properties: {}` or `additionalProperties` placeholders), do NOT treat the gap as a "no". Instead, note that the schema does not document that field and recommend the user verify with a real API call.
api_behavior:
rate_limiting:
- "Rate limit is 1000 requests per 60 seconds. Exceeding it returns 429. Implement exponential backoff."
error_format:
- "All v2 errors return: {\"error\": {\"status\": <code>, \"message\": \"...\", \"reason\": \"...\"}, \"traceId\": \"...\"}. Save traceId for support escalation."
http_403_types:
- "'Missing API privileges' = wrong module entitlement. Check API Entitlements page."
- "'Missing Data permissions' = correct module but restricted data-group scope. Contact RF admin."
language_defaults:
python: Use the requests library. Auth via headers dict.
powershell: Use Invoke-RestMethod. Auth via Headers parameter.
workflows:
- name: Enrich IOCs
triggers: [risk scores, malicious indicators, SIEM enrichment, IOC triage, IP lookup, domain lookup, hash lookup, URL lookup, threat intelligence enrichment]
steps:
- endpoint: "SOAR: Enrich"
slug: soar-enrich
why: Batch lookup up to 1000 IOCs. Returns risk scores and triggered risk rules. Start here for bulk triage.
- endpoint: "IP Address: Lookup"
slug: ip-lookup
why: Deep enrichment for individual IOCs. Use after SOAR Enrich to drill into high-risk indicators. Per-type variants: domain-lookup, hash-lookup, url-lookup. Fetch the slug matching the entity type you need.
- endpoint: "Links: Search"
slug: post_search
why: Relationship graph — connected threat actors, malware, or TTPs.
- endpoint: "IP Address: List Risk Rules"
slug: ip-risk-rules
why: List available risk rules for filtering or understanding what drove a risk score. Per-type variants: domain-risk-rules, hash-risk-rules, url-risk-rules.
also_read: [soar-get-contexts, get_metadata-entities, get_metadata-events, get_metadata-sections]
- name: Manage Watch Lists and Entity Lists
triggers: [watch list, tech stack, add entities to list, remove entities, track companies, custom list, entity list management]
steps:
- endpoint: "Lists: Search"
slug: lists-search
why: Find the target list by type (tech_stack, vulnerability, company, custom, etc.). Also covers entity ID formats and the 1000-entity limit in its documentation.
- endpoint: "Lists: Get Entities"
slug: lists-entities
why: Retrieve current members to avoid duplicates before adding.
- endpoint: "Entity: Match"
slug: entity-match
why: Resolve human-readable names to RF entity IDs. Required for complex entity types.
- endpoint: "Entity: Lookup"
slug: entity-lookup
why: Optional. Retrieve metadata for disambiguation when Entity Match returns multiple candidates.
- endpoint: "Links: Search"
slug: post_search
why: Optional. Enrich candidates with relationship data to rank match quality.
- endpoint: "Lists: Add Entity"
slug: lists-add-entity
why: Add resolved entities.
also_read: [lists-remove-entity, lists-create, lists-info, lists-status]
- name: Search and Triage Alerts
triggers: [alerts, triage, alert status, ticketing, alert integration, alert management]
variants:
- name: Standard Alerts
steps:
- endpoint: "Alerts: Search"
slug: get_v3
why: Find alerts by status, priority, rule, or time range.
- endpoint: "Alerts: Get by ID"
slug: get_v3-alert-id
why: Full alert detail.
- endpoint: "Alerts: Get Hits"
slug: get_v3-hits
why: Intelligence data that triggered the alert.
- name: Playbook Alerts
steps:
- endpoint: "Playbook Alerts: Search"
slug: playbook-alerts-search
why: Find playbook alerts with filters.
- endpoint: "Playbook Alerts: Preview"
slug: playbook-alerts-preview
why: Quick view of alert properties.
- endpoint: "Playbook Alerts: [Type] Detail"
slugs: [playbook-alerts-domain-abuse-detail, playbook-alerts-vulnerability-detail, playbook-alerts-code-repo-leakage-detail, playbook-alerts-third-party-risk-detail, playbook-alerts-identity-exposures-detail, playbook-alerts-geopolitics-facility-detail, playbook-alerts-malware-report-detail, playbook-alerts-bank-checks-detail, post_malicious-sites-playbook-alert-id, post_dark-web-brand-playbook-alert-id, post_social-media-impersonation-playbook-alert-id]
why: Type-specific detail. Fetch the slug matching the alert type (domain abuse, vulnerability, code repo leakage, third party risk, identity exposures, geopolitics facility, malware report, bank checks, malicious sites, dark web brand, social media impersonation).
- endpoint: "Playbook Alerts: Update"
slug: playbook-alerts-update
why: Change status, priority, or assignee.
also_read: [playbook-alerts-metadata, cases-create]
- name: Manage Cases
triggers: [cases, investigation, case management, escalation, assign case]
steps:
- endpoint: "Cases: Search"
slug: cases-search
why: Find existing cases by status, priority, assignee, or time range.
- endpoint: "Cases: Lookup"
slug: cases-lookup
why: Full detail on a specific case.
- endpoint: "Cases: Create"
slug: cases-create
why: Create from a reference alert or signal alert.
- endpoint: "Cases: Update"
slug: cases-update
why: Change assignee, status, priority, title, or description.
- endpoint: "Cases: Eligible Assignees"
slug: cases-eligible-assignees
why: List users who can be assigned.
- name: Vulnerability Intelligence
triggers: [CVE, vulnerability, exploit, vulnerability risk list, patch prioritization, vulnerability management]
steps:
- endpoint: "Entity: Match"
slug: entity-match
why: Resolve CVE IDs (e.g. CVE-2021-44228) to RF entity IDs. CVE strings are NOT valid entity IDs. This step is required.
- endpoint: "Vulnerability: Lookup"
slug: vulnerability-lookup
why: Full intelligence card for a vulnerability.
- endpoint: "Vulnerability: Search"
slug: vulnerability-search
why: Find vulnerabilities matching filter criteria.
- endpoint: "Vulnerability: List Risk Rules"
slug: vulnerability-risk-rules
why: Available risk rules and their criticality.
- endpoint: "Vulnerability: Download Risk List"
slug: vulnerability-risk-list
why: Bulk download of scored vulnerabilities for SIEM integration.
- endpoint: "Links: Search"
slug: post_search
why: Connected threat actors, malware, exploits, and affected products.
- name: Attack Surface Intelligence
triggers: [attack surface, external assets, exposures, ASI, asset discovery, asset tagging, exposure monitoring]
note: "Auth and base URL differ from Core API. Read the securitySchemes and servers fields from the endpoint docs fetched in this workflow."
steps:
- endpoint: "ASI Projects: List"
slug: project-list_projects
why: Find available projects. Required — all ASI operations are scoped to a project.
- endpoint: "ASI Assets: Find"
slug: assets-find_assets
why: Locate assets by type, exposure severity, tag, IP owner, or other filters. Alternative — assets-search_assets for complex queries.
- endpoint: "ASI Assets: Read"
slug: assets-read_asset
why: Detailed view of a single asset.
- endpoint: "ASI Assets: List Exposures"
slug: assets-list_asset_exposures
why: Specific exposures for an asset — ports, signatures, extracted versions.
- endpoint: "ASI Exposures: List"
slug: exposures-list_exposures
why: Browse exposures across the project.
also_read: [tagging-get_tags, tagging-add_tag, assets-apply_tag_to_asset, assets-bulk_add_remove_asset_tags, rules-get_static_assets, rules-add_static_assets]
- name: Threat Actor and Malware Research
triggers: [threat actors, malware families, TTPs, threat landscape, threat map, APT, threat intelligence research]
steps:
- endpoint: "Threat Maps: Available Maps"
slug: available-threat-maps
why: Discover which threat maps the user has access to.
- endpoint: "Threat Maps: Threat Actor Map"
slug: threat-actor-threat-map
why: Organizational threat landscape with opportunity/intent scores. Use malware-threat-map for malware focus. Use threat-actor-threat-map-org / malware-threat-map-org for multi-org enterprises.
- endpoint: "Threat Maps: Threat Actor Search"
slug: threat-actor-search
why: Find all known threat actors.
- endpoint: "Malware: Search"
slug: malware-search
why: Research specific malware families. Alternative — malware-lookup for a known entity.
- endpoint: "Links: Search"
slug: post_search
why: Relationships between actors, malware, TTPs, and infrastructure.
- endpoint: "Entity: Match"
slug: entity-match
why: Resolve entity names. Chain with entity-lookup for metadata.
also_read: [threat-actor-categories, malware-categories]
- name: Detection Engineering
triggers: [detection rules, Sigma, YARA, Snort, detection profiles]
variants:
- name: Find existing rules
steps:
- endpoint: "Detection Rules: Search"
slug: detection-rules-search
why: Search Insikt Group-authored YARA, Sigma, and Snort rules.
- endpoint: "Detection Rules: Associated Entities"
slug: detection-rules-associated-entities
why: Entities linked to detection rules, for filtering.
- name: Generate new rules
steps:
- endpoint: "Auto Sigma: Create Job"
slug: sigma-create-job
why: Kick off Sigma rule generation. Use yara-create-job for YARA rules.
- endpoint: "Auto Sigma: Get Job"
slug: sigma-get-job
why: Poll for completion and retrieve generated rule. Use yara-get-job for YARA.
- endpoint: "Auto Sigma: Update Job"
slug: sigma-update-job
why: Modify the generated rule. Use yara-edit-job for YARA.
- name: Identity and Credential Intelligence
triggers: [credentials, breached accounts, credential exposure, password exposure, credential dumps, identity intelligence]
steps:
- endpoint: "Identity: Search"
slug: identity-search
why: Search credential exposures for a set of domains.
- endpoint: "Identity: Lookup"
slug: identity-lookup
why: Detailed credential data for specific subjects.
- endpoint: "Identity: Hostname Lookup"
slug: identity-hostname
why: Credentials associated with a specific hostname.
- endpoint: "Identity: Password Lookup"
slug: identity-password
why: Check if specific passwords have been exposed.
- endpoint: "Identity: Dump Metadata Search"
slug: identity-dump-metadata
why: Check if a specific database dump is in the Identity Intelligence dataset.
- endpoint: "Identity: Incident Report"
slug: identity-incident-report
why: Exposure incident report for a single malware log.
- name: Malware Analysis and Sandboxing
triggers: [sandbox, file analysis, URL analysis, malware analysis, detonation, malware intelligence, PCAP, YARA, sandbox profile, sandbox search, sandbox report]
variants:
- name: Sandbox analysis
note: "Auth and base URL differ from Core API. Base URL is https://sandbox.recordedfuture.com/api/v0. Auth is Bearer token via Authorization header. Read the securitySchemes and servers fields from the endpoint docs fetched in this workflow."
steps:
- endpoint: "Sandbox: Submit Sample"
slug: sandbox-submit-sample
why: Submit a file or URL for analysis. Supports four modes — file upload, URL analysis, URL fetch, and import. Use interactive=true to pause after static analysis for manual profile selection, or omit for automatic mode. Optional defaults object controls timeout (max 3600s), network mode (internet/drop/tor/sim/vpn), and geolocation.
- endpoint: "Sandbox: Stream Sample Events"
slug: sandbox-stream-sample-events
why: Monitor analysis progress in real time. Returns current sample state then streams updates as newline-delimited JSON. Auto-closes when sample reaches terminal status (reported/failed). Preferred over polling Get Sample.
- endpoint: "Sandbox: Get Sample"
slug: sandbox-get-sample
why: Alternative to streaming. Poll analysis status. Use when streaming is not feasible.
- endpoint: "Sandbox: Select Profile"
slug: sandbox-select-profile
why: Required for interactive mode only. When sample reaches static_analysis status, use this to choose analysis profiles and continue processing.
- endpoint: "Sandbox: Get Sample Overview"
slug: sandbox-get-sample-overview
why: Primary high-level results. Returns malware config, signatures, IOCs, extracted artifacts, and MITRE ATT&CK mappings.
- endpoint: "Sandbox: Get Static Report"
slug: sandbox-get-static-report
why: Static analysis details — file metadata, hashes (MD5/SHA1/SHA256/SHA512/ssdeep), PE imports, signatures, and unpacked files.
- endpoint: "Sandbox: Get Dynamic Report"
slug: sandbox-get-dynamic-report
why: Behavioral analysis details — process tree, network flows, DNS/HTTP/TLS requests, extracted configs, MITRE ATT&CK TTPs, and risk score (0-10). Requires sampleID and taskID (e.g., behavioral1).
- endpoint: "Sandbox: Get Sample Summary"
slug: sandbox-get-sample-summary
why: Mid-level summary with per-task metadata including scores, platform details, tags, and backend info.
- name: URL analysis
note: "Use this variant when the submission is a URL rather than a file."
steps:
- endpoint: "Sandbox: Submit Sample"
slug: sandbox-submit-sample
why: Submit with kind=url. Generates a urlscan1 task in addition to behavioral tasks.
- endpoint: "Sandbox: Stream Sample Events"
slug: sandbox-stream-sample-events
why: Monitor until status reaches reported.
- endpoint: "Sandbox: Get URL Scan Report"
slug: sandbox-get-url-scan-report
why: URL-specific report with page metadata, network requests, and detected threats. Only available for samples with a urlscan1 task.
- endpoint: "Sandbox: Get URL Scan Screenshot"
slug: sandbox-get-url-scan-screenshot
why: Screenshot captured during URL scan analysis. Only available for URL-type submissions.
- endpoint: "Sandbox: Get Sample Overview"
slug: sandbox-get-sample-overview
why: Full analysis results combining URL scan and behavioral analysis.
- name: Forensic artifact retrieval
note: "Use after analysis completes to retrieve network captures, execution logs, and dumped files for deep forensic investigation."
steps:
- endpoint: "Sandbox: Download PCAP"
slug: sandbox-download-pcap
why: Network capture for a specific task. Compatible with Wireshark/tcpdump. Use for basic traffic analysis.
- endpoint: "Sandbox: Download PCAPNG"
slug: sandbox-download-pcapng
why: Extended network capture including decrypted HTTPS traffic. Requires Wireshark/TShark v3+. Prefer over PCAP when HTTPS decryption is needed.
- endpoint: "Sandbox: Get Task Logs"
slug: sandbox-get-task-logs
why: Kernel monitor and behavioral logs. Log types — onemon (Windows), stahp (Linux), bigmac (macOS), droidy (Android). Returns newline-delimited JSON.
- endpoint: "Sandbox: Download Task File"
slug: sandbox-download-task-file
why: Retrieve a specific file dumped during execution or a memory dump from analysis.
- endpoint: "Sandbox: Download Archive (ZIP)"
slug: sandbox-download-archive-zip
why: Complete sample archive — all reports, network captures, dumped files, and configs in one download. Alternative — sandbox-download-archive-tar for TAR format.
- endpoint: "Sandbox: Download Sample"
slug: sandbox-download-sample
why: Retrieve the original submitted file (unencrypted binary). File submissions only.
- name: Sandbox search and history
note: "Use to search across past analyses or browse submission history."
steps:
- endpoint: "Sandbox: Search"
slug: sandbox-search
why: Query all sandbox analyses using a rich query language. Supports hash lookups (md5/sha1/sha256/sha512), family/tag filters (family:wannacry, tag:ransomware), network indicators (url/domain/ip), date ranges (from:/to:), and Boolean operators (AND/OR/NOT). Max 200 results per page.
- endpoint: "Sandbox: List Samples"
slug: sandbox-list-samples
why: Browse submissions by scope — owned (your submissions), org (organization-wide), or public. Supports pagination.
- endpoint: "Sandbox: Get Sample"
slug: sandbox-get-sample
why: Detailed info on a specific sample including its analysis tasks.
- endpoint: "Sandbox: Delete Sample"
slug: sandbox-delete-sample
why: Remove a sample and all associated analysis data. Note — public cloud users typically cannot delete samples.
- name: Sandbox profile management
note: "Profiles define reusable analysis configurations — OS, network mode, timeout, browser. Manage them before submitting samples."
steps:
- endpoint: "Sandbox: List Resources"
slug: sandbox-list-resources
why: Discover available VM images, platforms (e.g., windows10-1703_x64), and capacity limits. Use this to determine valid tags for profile creation.
- endpoint: "Sandbox: List Geolocations"
slug: sandbox-list-geolocations
why: List available VPN geolocations. Required when creating a profile with network mode vpn.
- endpoint: "Sandbox: List Profiles"
slug: sandbox-list-profiles
why: View existing profiles. Profile names must be unique within the organization.
- endpoint: "Sandbox: Create Profile"
slug: sandbox-create-profile
why: Create a reusable profile. Required fields — name, tags (OS/locale), timeout (max 3600s), network mode (internet/drop/tor/sim200/sim404/simnx/vpn). Optional — geolocation (required for vpn), browser (chrome/firefox).
- endpoint: "Sandbox: Get Profile"
slug: sandbox-get-profile
why: Retrieve a specific profile by ID or name.
- endpoint: "Sandbox: Update Profile"
slug: sandbox-update-profile
why: Overwrite a profile's configuration. Full profile object (excluding id) must be provided.
- endpoint: "Sandbox: Delete Profile"
slug: sandbox-delete-profile
why: Remove a profile by ID or name.
- name: Sandbox YARA rule management
note: "Create and manage custom YARA rules that run against sandbox submissions. Rules are compiled and validated on save."
steps:
- endpoint: "Sandbox: List YARA Rules"
slug: sandbox-list-yara-rules
why: List all accessible rules. Returns names only — use Get YARA Rule for content.
- endpoint: "Sandbox: Create YARA Rule"
slug: sandbox-create-yara-rule
why: Create a new rule. Provide name (e.g., my_rule.yar) and rule content. Compiled and validated on creation. Include triage_score, description, and triage_description metadata for integration with analysis results.
- endpoint: "Sandbox: Get YARA Rule"
slug: sandbox-get-yara-rule
why: Retrieve a rule's source content and any compilation warnings.
- endpoint: "Sandbox: Update YARA Rule"
slug: sandbox-update-yara-rule
why: Update rule content or rename. Recompiled and validated on save.
- endpoint: "Sandbox: Delete YARA Rule"
slug: sandbox-delete-yara-rule
why: Remove a rule by name.
- name: Real-time monitoring
note: "Stream live analysis events across all samples or a specific sample."
steps:
- endpoint: "Sandbox: Stream All Events"
slug: sandbox-stream-all-events
why: Organization-wide event stream. Emits real-time state changes for all visible samples. Does not replay initial state — only new events. Connection remains open indefinitely.
- endpoint: "Sandbox: Stream Sample Events"
slug: sandbox-stream-sample-events
why: Single-sample event stream. Returns current state then streams updates. Auto-closes on terminal status.
- name: Malware intelligence queries
steps:
- endpoint: "Malware Intelligence: Query by IOCs"
slug: malware-intelligence-query-iocs
why: Search by known indicators.
- endpoint: "Malware Intelligence: Query Natural Language"
slug: malware-intelligence-query-nl
why: Free-text search.
- endpoint: "Malware Intelligence: Get Sandbox Reports"
slug: malware-intelligence-sandbox-reports
why: Highest-scoring sandbox reports matching a query.
also_read: [sandbox-list-resources, sandbox-list-geolocations, sandbox-download-archive-tar, sandbox-download-pcapng]
- name: Risk List Downloads
triggers: [risk list, SIEM integration, firewall feed, threat feed, indicator feed, risk list download]
note: "Risk lists are available per entity type. Each type follows the same three-endpoint pattern with slugs {type}-risk-rules, {type}-risk-list, {type}-stat-risk-list where {type} is one of ip, domain, hash, url, vulnerability. The steps below show the ip slugs."
steps:
- endpoint: "IP Address: List Risk Rules"
slug: ip-risk-rules
why: List available risk rules and entity counts per rule. Per-type slugs: domain-risk-rules, hash-risk-rules, url-risk-rules, vulnerability-risk-rules.
- endpoint: "IP Address: Download Risk List"
slug: ip-risk-list
why: Download the list. Use the list parameter to filter by risk rule. Without it, returns the default risk list. Per-type slugs: domain-risk-list, hash-risk-list, url-risk-list, vulnerability-risk-list.
- endpoint: "IP Address: Stat Risk List"
slug: ip-stat-risk-list
why: Check if list has changed (ETag-based) without downloading the full file. Per-type slugs: domain-stat-risk-list, hash-stat-risk-list, url-stat-risk-list, vulnerability-stat-risk-list.
- name: Payment Fraud Intelligence (PFI)
triggers: [payment fraud, card fraud, compromised cards, BIN data, bank accounts, checks, magecart, e-skimmer, card testing, CPP, common point of purchase, PFI]
note: "Auth and base URL differ from Core API. Read the securitySchemes and servers fields from the endpoint docs fetched in this workflow. All bulk data endpoints are asynchronous — submit a query, monitor the task, then retrieve results. Max 2 tasks run concurrently; additional tasks queue FIFO."
variants:
- name: Bulk data retrieval
steps:
- endpoint: "PFI: [Data Type]"
slugs: [pfi-full-card-data, pfi-partial-card-data, pfi-sold-partial-card-data, pfi-check-data, pfi-bank-account-data, pfi-cpp-merchant-data, pfi-magecart-domain-data, pfi-magecart-merchant-data, pfi-magescanner-scan-data, pfi-tester-merchant-data]
why: Submit a bulk data query. Choose the endpoint matching your data need — Full Card Data, Partial Card Data, Sold Partial Card Data, Check Data, Bank Account Data, CPP Merchant Data, Magecart Domain Data, Magecart Merchant Data, Magescanner Scan Data, or Tester Merchant Data. Use dryRun at the root level of the request body to preview record count without creating a task.
- endpoint: "PFI: Task Status"
slug: pfi-task-status
why: Poll task progress. Wait at least 1 minute after submission, then poll no more than once per minute. Task is complete when completedAt is non-null.
- endpoint: "PFI: Pickup Data"
slug: pfi-pickup-data
why: Retrieve results. Returns newline-delimited JSON (one object per line, not a JSON array). For CSV format, you must explicitly list column names.
- name: Task management
steps:
- endpoint: "PFI: List Tasks"
slug: pfi-list-tasks
why: See queued tasks waiting to run. Tasks leave the queue once they start executing.
- endpoint: "PFI: Task Status"
slug: pfi-task-status
why: Check progress of a specific task by ID.
- endpoint: "PFI: Delete Task"
slug: pfi-delete-task
why: Remove a queued task before it starts. Only works on tasks that haven't begun running.
- name: Document image retrieval
steps:
- endpoint: "PFI: Bank Account Data"
slug: pfi-bank-account-data
why: First retrieve bank account records to get record IDs. Alternative — pfi-check-data for check records.
- endpoint: "PFI: Bank Account Images"
slug: pfi-bank-account-images
why: Submit record IDs (max 100) to prepare images for download. Completes in seconds. Alternative — pfi-check-images for check document images.
- endpoint: "PFI: Task Status"
slug: pfi-task-status
why: Confirm the image preparation task completed.
- endpoint: "PFI: Pickup Data"
slug: pfi-pickup-data
why: Download the prepared images using the image task ID.
- name: Magecart domain scanning
note: Requires Magecart-specific module entitlement beyond standard PFI access.
steps:
- endpoint: "PFI: Add Scan Domains"
slug: pfi-add-scan-domains
why: Submit up to 10,000 domains for e-skimmer scanning. Adds to your custom scanning queue.
- endpoint: "PFI: Clear Scan Queue"
slug: pfi-clear-scan-queue
why: Empty the custom scanning queue if needed.
- endpoint: "PFI: Magecart Domain Data"
slug: pfi-magecart-domain-data
why: Retrieve scan results. Also pfi-magescanner-scan-data for automated scan results.
also_read: [api-entitlements]
- name: Collective Insights
triggers: [collective insights, detection enrichment, submit IOCs, detection telemetry, enriched detections, SIEM detections, security telemetry, bidirectional intelligence]
steps:
- endpoint: "Collective Insights: Overview"
slug: collective-insights
why: Read first. Explains the bidirectional pipeline and data flow.
- endpoint: "Collective Insights: Submit Detections"
slug: collective-insights-submit-detections
why: Ingest IoC detections (IP, domain, hash, vulnerability, URL) from security tools. Pair each IoC with a detection type (detection_rule, correlation, playbook, or sandbox). Use options.debug=true for test submissions. Invalid IoC types are silently dropped — check processed counts in the response.
- endpoint: "Collective Insights: Search"
slug: collective-insights-search
why: Query enriched detection history. Aggregates events from API submissions, integrations, Autonomous Threat Operations, and Sandbox. Filter by malware, threat actors, MITRE codes, indicator type, detection type, or time range. Paginate with next_offset.
- endpoint: "Entity: Match"
slug: entity-match
why: Resolve Recorded Future entity IDs returned in search results to get additional entity details.
cross_workflow_endpoints:
- endpoint: "Entity: Match"
slug: entity-match
when: "You have a human-readable name and need an RF entity ID. Skip this for IPs, domains, hashes, URLs, emails, ASNs, and other prefix types: build the ID directly (ip:8.8.8.8, idn:example.com) per available-entity-types."
- endpoint: "Entity: Lookup"
slug: entity-lookup
when: You need metadata (aliases, type) for a known entity ID.
- endpoint: "Links: Search"
slug: post_search
when: You need to understand relationships between entities.
- endpoint: "Links: Metadata Entities"
slug: get_metadata-entities
when: Building dynamic entity type filters for Links Search.
- endpoint: "Links: Metadata Events"
slug: get_metadata-events
when: Building dynamic event type filters for Links Search.
- endpoint: "Links: Metadata Sections"
slug: get_metadata-sections
when: Building dynamic section filters for Links Search.
- endpoint: "Enrichment: Field Attributes"
slug: enrichment-field-attributes
when: Understanding available fields for enrichment queries.
- endpoint: "Company: Lookup by Domain"
slug: company-lookup-by-domain
when: You have a domain and need to identify the owning company.
- endpoint: "API Entitlements"
slug: api-entitlements
when: You get a 403/Forbidden error and need to check which module license is required for a specific API. If the required module is not part of your current license, contact your Recorded Future account team to discuss adding it.
- endpoint: "Collective Insights: Submit Detections"
slug: collective-insights-submit-detections
when: You want to feed IOCs discovered through other workflows (PFI, alerts, risk lists) back into the Collective Insights enrichment pipeline.
verification_code: RF-DOCS-2026Q4