What this endpoint does

Publishes one or more threat intelligence reports to a specific custom source for asynchronous processing and enrichment by Recorded Future. Each report must include at least one observable (IP address, domain, URL, or hash) using Recorded Future's prefixed entity format (e.g., ip:203.0.113.1, idn:example.com, hash:abc123..., url:https://...). Reports can optionally include MITRE ATT&CK technique references using the mitre: prefix, TLP classification for sharing controls, and associations with malware or threat actor entities. Use the Create Source endpoint to obtain a source UUID before publishing, and the Entity: Match endpoint to convert malware or threat actor names into the entity IDs required by the malware and threatActor fields.

Response data

Returns HTTP 202 with no response body, indicating the reports have been accepted for asynchronous processing. There is no job ID or tracking reference in the response — use the externalId field in each submitted report as your own correlation key for tracking purposes. After processing, the submitted observables are enriched with Recorded Future intelligence and become available through the platform. Invalid entity references (malware, threat actor, or TTP IDs) will result in a 422 error before processing begins.