What this endpoint does

This endpoint searches for URL entities matching specified filters and returns paginated results with optional enrichment data. Filters include risk score range, specific risk rule (use the URL Risk Rules endpoint for valid rule names), first/last seen date windows, free-text search, and sorting by risk score, recency, or hit counts. URL risk scores tend to be lower than other entity types — scores above 90 are rare, so use a broader range when searching. Each page returns up to 1,000 results with a maximum pagination window of 10,000 total results. Use the fields parameter to control which enrichment data is included for each result — without it, only basic entity identification is returned.

Response data

The response contains a results array where each entry includes the URL entity identification (with an ID in the format url: followed by the full URL) and any enrichment sections specified in the fields parameter (matching the same field options as the URL Lookup endpoint, such as entity, risk, links, and aiInsights). A counts object reports how many results were returned in this page and how many total results match the filters. Combine riskRule filters with risk score ranges to find URLs associated with specific threat categories such as phishing, malware delivery, or C2 communication.