---
title: "Get a single active risk rule with enriched evidence"
method: POST
path: "/active/rule"
tags: ["Active Risks"]
---

# Get a single active risk rule with enriched evidence

`POST /active/rule`

Fetch a single active risk rule for a company with paginated, rule-type-specific enriched evidence (open ports, leaked credentials, vulnerable products).

## Request body

- GetActiveRiskRuleRequest
  - `company` string, required
  - `rule_alias` string, required
  - `limit` integer — Max number of evidence records to return (where supported)
  - `offset` integer — Evidence offset for pagination (where supported)

## Response `200`

A single active risk rule (if active).

- GetActiveRiskRuleResponse
  - `entity` Entity, required
    - `id` string, required — Entity id
    - `provided_id` string, required — Entity id provided in request
    - `type` string, required — Entity type
    - `name` string, required — Entity name
  - `risk_rule` ActiveRiskRule
    - `risk_id` string, required
    - `risk_name` string, required
    - `rule_alias` string, required
    - `criticality` integer, required
    - `evidence` string, required
    - `added` string, date-time
    - `removed` string, date-time, nullable
    - `enriched_evidence` union
      - OpenPortEvidence
        - `evidence_type` 'openPort', required — Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results` object[], required
          - `ip` string, required
          - `port` integer, required
          - `first_seen` string, date-time, required
          - `last_seen` string, date-time, required
        - `next_offset` integer, nullable
      - LeakedCredentialsEvidence
        - `evidence_type` 'credentialDetails', required — Discriminator identifying this evidence type
        - `entity_id` string, required
        - `rule_alias` string, required
        - `total` integer, required
        - `results` object[], required
          - `email` string, required
          - `password` string, required
          - `document_title` string, required
          - `document_publish_date` string, date-time, required
      - ReferenceListEvidence
        - `evidence_type` 'referenceList', required — Discriminator identifying this evidence type
        - `total` integer, required — Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable — Event title
          - `fragment` string, nullable — Event fragment/excerpt
          - `published` string, date-time, required — Event publication date
          - `document_url` string, nullable — URL to the source document
          - `source` string, nullable — Source identifier
      - AttributeEvidence
        - `evidence_type` 'attribute', required — Discriminator identifying this evidence type
        - `value_type` 'domain', required — Type of attribute value
        - `results` object[], required
          - `value` string, required — Domain entity identifier
          - `added` string, date-time, required — Date when the attribute was added
          - `domain_owner` string, nullable — Domain owner entity identifier
      - CompanyIpEvidence
        - `evidence_type` 'companyIp', required — Discriminator identifying this evidence type
        - `total` integer, required
        - `results` object[], required
          - `ip` string, required
          - `ip_risk_rule` string, required
          - `added` string, date-time, required
        - `next_offset` integer, nullable
      - CompanySusceptibleToEvidence
        - `evidence_type` 'companySusceptibleTo', required — Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results` object[], required
          - `cve_id` string, required
          - `ip` string, required
          - `owner` string, required
          - `timestamp` string, date-time, required
        - `next_offset` integer, nullable
      - ProductRiskEvidence
        - `evidence_type` 'productRisk', required — Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results_in_page` integer, required
        - `results` object[], required
          - `domain` string, required
          - `product_identifier` string, required
          - `cve_id` string, nullable — Optional CVE identifier (may be null)
          - `first_seen` string, date-time, required
          - `last_seen` string, date-time, required
          - `product_risk_rule_name` string, required
        - `next_offset` integer, nullable
      - PatternEvidence
        - `evidence_type` 'pattern', required — Discriminator identifying this evidence type
        - `total` integer, required — Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable — Event title
          - `fragment` string, nullable — Event fragment/excerpt
          - `published` string, date-time, required — Event publication date
          - `document_url` string, nullable — URL to the source document
          - `source` string, nullable — Source identifier
      - CyberTrendsEvidence
        - `evidence_type` 'cyberTrends', required — Discriminator identifying this evidence type
        - `total` integer, required — Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable — Event title
          - `fragment` string, nullable — Event fragment/excerpt
          - `published` string, date-time, required — Event publication date
          - `document_url` string, nullable — URL to the source document
          - `source` string, nullable — Source identifier

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)