What this endpoint does

This endpoint downloads a bulk file of URLs from the Recorded Future URL risk list, intended for ingestion into SIEMs, SOARs, web proxies, and other security tools for URL blocking and detection. By default it returns the "default" risk list; use the list parameter with a risk rule name to filter to URLs that trigger a specific rule and have a risk score of 25 or above. Use the URL Risk Rules endpoint to retrieve valid risk rule names and see how many URLs each rule covers. The response is a file download (not paginated JSON), available in CSV/Splunk format by default or in STIX 1.1.1, STIX 1.2, or STIX 2.1 formats. Use the companion HEAD endpoint to retrieve an ETag hash for change-detection polling without downloading the full file.

Response data

The default CSV format contains four columns: Name (the full URL without the url: entity ID prefix), Risk (numeric score 0-99), RiskString (triggered rules vs total rules evaluated), and EvidenceDetails (a JSON-encoded array of evidence objects including rule name, evidence string, criticality label, source citations, and timestamps for each triggered rule). Some risk rules cover very large numbers of URLs — for example, "Historically Suspected Phishing Techniques" covers over 160 million URLs — so use targeted risk rule filters to manage download sizes.