---
title: "Lookup Company by domain"
method: GET
path: "/company/by_domain/{domain}"
tags: ["Company"]
---

# Lookup Company by domain

`GET /company/by_domain/{domain}`

Resolve a domain to its associated company entity with risk scoring and threat intelligence enrichment.

## Path parameters

- `domain` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `comment` string

## Response `200`

Result of operation

- CompanyByDomainResponse — Company entity resolved from a domain name, with risk assessment data.
  - `data` object, required — Company entity data resolved from domain lookup.
    - `entity` Entity
      - `id` string, required — Entity id
      - `provided_id` string, required — Entity id provided in request
      - `type` string, required — Entity type
      - `name` string, required — Entity name
    - `risk` RiskData — Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities.
      - `score` integer — Numeric risk score from 0 (no risk) to 99 (critical risk).
      - `criticality` integer — Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
      - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
      - `riskString` string — Triggered vs total risk rules (e.g., '16/81').
      - `rules` integer — Number of currently triggered risk rules.
      - `riskSummary` string — Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.').
      - `evidenceDetails` EvidenceDetail[] — Evidence for each triggered risk rule.
        - `rule` string — Risk rule name that was triggered.
        - `criticality` integer — Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `evidenceString` string — Human-readable evidence summary with source references and sighting details.
        - `mitigationString` string — Recommended mitigation or remediation guidance for this risk rule.
        - `timestamp` string, date-time — ISO 8601 timestamp of when the evidence was observed.
    - `curated` boolean — Whether this company entity has been editorially curated.
    - `timestamps` Timestamps — First and last seen timestamps for the entity in Recorded Future data.
      - `firstSeen` string, date-time — ISO 8601 timestamp of first observation.
      - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation.
  - `metadata` object — Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)