Find URLs by risk score, risk rules, or date ranges with paginated enrichment results.
What this endpoint does
Searches the Recorded Future URL intelligence dataset with filtering and optional enrichment. Key filters: riskRule (a specific rule name — use URL: List Risk Rules for the complete list, as the spec's enum is missing 8 valid rules), riskScore (range notation like [75,)), freetext (substring match), and firstSeen/lastSeen date windows. Use fields to control enrichment depth. URL risk scores tend lower than other IOC types — scores above 90 are uncommon.
Response data
Returns data.results (array of URL entity objects) and a top-level counts object (returned, total) alongside data. Each entity id is url: followed by the full URL string. Paginate with limit (max 1000) and from (offset); limit + from must not exceed 1,000 or the API returns 400. The limit parameter has a default value of 10. The intention is to use pagination to get further results. Though limit can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs.