What this endpoint does

Retrieves the risk history for one or more entities over a specified date range, showing how risk scores, criticality levels, and individual risk rules have changed over time. This works with any Recorded Future entity type — companies, IP addresses, domains, hashes, URLs, vulnerabilities, and more. Provide entity IDs (obtainable via the Entity: Match endpoint or entity-specific search/lookup endpoints) and an optional date range — if omitted, the range defaults to a 30-day window. Each risk rule entry shows when it became active and when it was resolved, so you can distinguish between currently active risks (no removed date) and historical risks that were triggered and later cleared within the requested period.

Response data

Returns three parallel history tracks for each entity. The scores array shows how the overall numeric risk score changed over time, with each entry recording the score value and its active window. The levels array tracks criticality level changes (integer severity ratings) over time. The risk_rules array — which can be very large for major entities — records each individual risk rule activation and deactivation, including the rule name, criticality, and an evidence summary describing what triggered it. For company entities, use the Risk: Get Active Rule endpoint to retrieve detailed enriched evidence for any currently active rule.

200A list of risk histories.