What this endpoint does

Retrieves a specific risk rule for a company entity and returns its current status along with paginated evidence. Risk rules represent specific security risk indicators — such as open exploitable ports, leaked credentials, vulnerability susceptibility, or product-level risks — that Recorded Future continuously evaluates for companies. Each rule is identified by an alias (e.g., "openPort", "credentialDetails", "companySusceptibleTo"). If the requested rule is currently active (triggered by observed evidence), the response includes the rule details and structured evidence; if the rule is not active, only the entity information is returned. Use the Company: Search or Company: Lookup endpoints to obtain company entity IDs, and the Risk: Search Histories endpoint to discover which rule aliases are available.

Response data

Returns the resolved company entity and, when the rule is active, its risk rule details including the rule name, criticality level, a timestamp indicating when the rule was triggered, and a text summary of the evidence with embedded entity references. The enriched_evidence field provides paginated structured evidence whose format varies by rule type — for example, open port evidence includes IP addresses with port numbers and observation timestamps, while leaked credential evidence includes email addresses and source documents. Use the limit and offset parameters to page through large evidence sets, with next_offset indicating whether more records are available.

200A single active risk rule (if active).