What this endpoint does

Retrieves the risk history for one or more entities over a specified date range, showing how risk scores, criticality levels, and individual risk rules have changed over time. The endpoint returns change events — not daily snapshots — so each entry represents a period during which a value was active. This works with any Recorded Future entity type — companies, IP addresses, domains, hashes, URLs, vulnerabilities, and more. Provide entity IDs (obtainable via the Entity: Match endpoint or entity-specific search/lookup endpoints) and an optional date range — if omitted, the range defaults to a 30-day window.

Response data

Returns three change-based history tracks for each entity:

• scores — one entry per risk score change, with the score value, the timestamp it became active (added), and the timestamp it was replaced (removed).
• levels — criticality (integer severity) changes, recorded the same way.
• risk_rules — each individual rule activation and deactivation, with the rule name, criticality, and an evidence summary. This array can be very large for major entities.

Because entries are change-based, an entry's added date can fall before the requested from date if the value has been stable across the window. For example, an entity whose risk score has held steady since 2022 returns a single scores entry with added in 2022 and no removed date — even when querying only the last 30 days. The risk_rules array typically shows more entries within a short window because individual rules age in and out more frequently than the overall score.

An entry without a removed date is currently active. To build a daily time-series, treat each value as constant between its added and removed timestamps (or up to now if removed is absent).

For company entities, use the Risk: Get Active Rule endpoint to retrieve detailed enriched evidence for any currently active rule.