---
title: "Search for Company entities based on a filter"
method: GET
path: "/company/search"
tags: ["Company"]
---

# Search for Company entities based on a filter

`GET /company/search`

Find companies by name, risk score, industry, or risk rules with paginated risk assessment results.

## Query parameters

- `freetext` string
- `fields` string
- `metadata` unknown
- `limit` integer
- `from` integer
- `riskScore` string
- `firstSeen` string
- `lastSeen` string
- `list` string
- `parent` string
- `industry` string
- `domicile` string
- `riskRule` 'analystNote' | 'certExpired' | 'certSelfSigned' | 'cyberSignalCritical' | 'cyberSignalHigh' | 'cyberSignalMedium' | 'dkimImproper' | 'dkimweak' | 'dmarcAbsent' | 'dnsSandwichTargetedDomain' | 'exploitableInfrastructure' | 'exploitedProduct' | 'highCreds' | 'highPasswordCreds' | 'highTierHighVolume' | 'highTierModerateVolume' | 'hsts' | 'infrastructureAbuse' | 'infrastructureInfection' | 'likelyViolation' | 'marketHighVolume' | 'marketModerateVolume' | 'moderateCreds' | 'moderatePasswordCreds' | 'openPort' | 'possibleMalware' | 'possibleViolation' | 'punyCodeTargetedDomain' | 'ransomwareExtortion' | 'recentAnalystNote' | 'recentCncCommunication' | 'recentDnsSandwichTargetedDomain' | 'recentExploitableInfrastructure' | 'recentHighCreds' | 'recentHighPasswordCreds' | 'recentHighTierHighVolume' | 'recentHighTierModerateVolume' | 'recentInfrastructureAbuse' | 'recentInfrastructureInfection' | 'recentMarketHighVolume' | 'recentMarketModerateVolume' | 'recentModerateCreds' | 'recentModeratePasswordCreds' | 'recentPossibleMalware' | 'recentPunyCodeTargetedDomain' | 'recentRansomwareExtortion' | 'recentReportedCyberAttack' | 'recentSecurityBreach' | 'recentSingleSourceCreds' | 'recentSingleSourcePasswordCreds' | 'recentSuspectedCncCommunication' | 'recentSuspectedDdosAttack' | 'recentTypoTargetedDomain' | 'recentValidatedCyberAttack' | 'reportedCyberAttack' | 'securityBreach' | 'singleSourceCreds' | 'singleSourcePasswordCreds' | 'spfMultiple' | 'spfOverlyPermissive' | 'spfUnrestricted' | 'sslTlsVuln' | 'sslWeak' | 'tlsWeak' | 'topicalVulnerability' | 'typoTargetedDomain' | 'unsupportedProduct' | 'validatedCyberAttack' | 'vulnerableProduct'
- `orderBy` 'created' | 'modified' | 'sixtydayshits' | 'sevendayhits' | 'criticality' | 'riskscore' | 'totalhits' | 'firstseen' | 'lastseen' | 'rules'
- `direction` 'asc' | 'desc'
- `comment` string

## Response `200`

Result of operation

- SearchResponseWithMetadata — Paginated search results for entities matching the specified filters.
  - `data` object, required
    - `results` object[], required — Array of matching entity objects. Each includes entity identification and enrichment data controlled by the fields parameter.
      - `entity` object — Entity identification.
        - `id` string — Recorded Future entity ID (e.g., ip:8.8.8.8, idn:example.com, hash:abc123)
        - `name` string — Entity display name
        - `type` string — Entity type classification (e.g., IpAddress, InternetDomainName, Hash, CyberVulnerability, Malware, Company, URL)
        - `description` string — Entity description (present for vulnerabilities and some other types).
      - `risk` object — Risk assessment data (included when fields contains 'risk').
        - `score` integer — Numeric risk score (0-99)
        - `criticality` integer — Numeric criticality level (1-4)
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `riskString` string — Triggered rules vs total rules (e.g., 16/81)
        - `rules` integer — Number of triggered risk rules
        - `riskSummary` string — Human-readable risk summary
        - `evidenceDetails` object[] — Evidence for each triggered risk rule.
          - `rule` string — Risk rule description
          - `criticality` integer — Rule criticality level
          - `criticalityLabel` string — Rule criticality label
          - `evidenceString` string — Human-readable evidence summary
          - `timestamp` string — ISO 8601 timestamp of the evidence
      - `timestamps` object — First and last seen timestamps for the entity.
        - `firstSeen` string, date-time — ISO 8601 timestamp of first observation.
        - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation.
  - `counts` CountsData, required — Pagination counts.
    - `returned` integer — Number of results in this response page
    - `total` integer — Total number of matching results across all pages
  - `metadata` object — Request metadata (included when metadata=true).
    - `entries` object[] — Metadata entries describing query parameters and their values.
      - `key` string — Parameter name.
      - `label` string — Human-readable label.
      - `type` string — Parameter type.
      - `item` object — Parameter value details.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)