What this endpoint does

This endpoint returns enrichment data for a single URL, controlled by the fields parameter which selects which categories of intelligence to include. For URL triage and threat assessment, request the core fields entity,risk,aiInsights,links,intelCard to get identification, risk scoring with triggered rule evidence, AI-generated analysis identifying associated malware families and attack patterns, technically validated relationships (MITRE ATT&CK techniques, threat actors, malware), and an Intelligence Card URL. URL risk scores tend to be lower than other IOC types — a score of 79 with 12 triggered rules represents a heavily flagged URL. The URL entity ID format is url: followed by the full URL (e.g., url:http://example.com/path), and must be URL-encoded when placed in the API path; use the URL: Search endpoint to find URLs by risk score, risk rules, or time range. Call GET /v2/url/fields to list valid field names programmatically, or consult the Enrichment: Field Attributes reference.

Response data

The response contains a data object with only the enrichment sections specified in the fields parameter. The risk section provides a numeric score (0-99), criticality label, count of triggered rules out of 35 total URL risk rules, and detailed evidence for each triggered rule including source citations and MITRE ATT&CK technique associations. The aiInsights section provides an AI-generated paragraph analyzing the URL's threat context, associated malware families, and attack patterns. The links section contains technically validated relationships from sandbox analysis and Insikt Group research — distinct from relatedEntities which reflects co-occurrence in articles and can be very large. URL entities use the same enrichment fields as other IOC types but have no URL-specific extra fields.