---
title: "Lookup a Company entity by id"
method: GET
path: "/company/{id}"
tags: ["Company"]
---

# Lookup a Company entity by id

`GET /company/{id}`

Get full company enrichment including risk scoring, triggered-rule evidence, analyst notes, and relationships.

## Path parameters

- `id` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `taggedText` boolean
- `comment` string

## Response `200`

Result of operation

- CompanyLookupResponse — Company enrichment response. Company entities have risk scores but do not support aiInsights or links fields. The response includes only the fields specified in the `fields` query parameter.
  - `data` object, required — Company entity data with requested enrichment fields.
    - `entity` Entity
      - `id` string, required — Entity id
      - `provided_id` string, required — Entity id provided in request
      - `type` string, required — Entity type
      - `name` string, required — Entity name
    - `risk` RiskData — Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities.
      - `score` integer — Numeric risk score from 0 (no risk) to 99 (critical risk).
      - `criticality` integer — Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
      - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
      - `riskString` string — Triggered vs total risk rules (e.g., '16/81').
      - `rules` integer — Number of currently triggered risk rules.
      - `riskSummary` string — Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.').
      - `evidenceDetails` EvidenceDetail[] — Evidence for each triggered risk rule.
        - `rule` string — Risk rule name that was triggered.
        - `criticality` integer — Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `evidenceString` string — Human-readable evidence summary with source references and sighting details.
        - `mitigationString` string — Recommended mitigation or remediation guidance for this risk rule.
        - `timestamp` string, date-time — ISO 8601 timestamp of when the evidence was observed.
    - `intelCard` string, uri — URL to the Recorded Future Intelligence Card for this company.
    - `counts` object[] — Daily reference count time-series. Can be very large (97KB+) for well-known companies.
    - `analystNotes` object[] — Insikt Group analyst notes.
    - `relatedEntities` object[] — Co-occurrence relationships (not editorially validated).
    - `metrics` object[] — Flat metric counters.
  - `metadata` object — Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)