---
title: "Fetch risk information for a set of indicators"
method: POST
path: "/enrichment"
tags: ["Soar"]
---

# Fetch risk information for a set of indicators

`POST /enrichment`

Retrieve risk scores, triggered rules, and evidence for up to 1,000 indicators across six entity types in a single batch call.

## Query parameters

- `metadata` boolean

## Request body

- EnrichRequest — Entities to be enriched, grouped by type up to a total of 1000 IOCs.
  - `ip` string[] — IPs to enrich
  - `domain` string[] — Domains to enrich
  - `url` string[] — URLs to enrich
  - `hash` string[] — Hashes to enrich
  - `vulnerability` string[] — Vulnerabilities to enrich
  - `companybydomain` string[] — Companies to enrich, identified by their domain name.

## Response `200`

output

- EnrichResponse — Enrichment results with risk scores, evidence, and threat context for submitted entities.
  - `data` EnrichResponseData, required — Data wrapper containing enrichment result entries.
    - `results` object[], required — Individual enrichment result for a single entity.
      - `risk` object, required
        - `score` number, required — Overall risk score for this entity (0-99).
        - `level` number, required — Risk level category (0=None, 1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
        - `context` object, required — Risk context data keyed by context name (e.g., phishing, c2, malware, public). Each key represents a risk context use case.
        - `rule` object, required — Aggregate risk rule data for this entity across all contexts.
          - `summary` object[] — Summary of triggered rules grouped by severity level.
            - `level` number, required — Severity level (1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
            - `count` number, required — Number of rules triggered at this severity level.
          - `mostCritical` string — Name of the most critical (highest severity) rule triggered.
          - `count` integer, required — Total number of risk rules triggered for this entity.
          - `maxCount` integer, required — Maximum number of risk rules available for this entity type.
          - `evidence` object — Evidence data keyed by rule identifier (e.g., spamSiteDetected, historicalThreatListMembership, defanged). Each key is a camelCase rule slug.
      - `entity` object, required
        - `id` string, required
        - `name` string, required
        - `type` string, required
        - `description` string
  - `counts` Counts, required — Pagination counts for list responses.
    - `returned` number, required
    - `total` number, required
  - `metadata` Metadata — Response metadata with additional context about the enrichment operation. Only included when the metadata query parameter is set to true.
    - `entries` object[] — Metadata entries providing additional context about the response data elements.
      - `key` string — The metadata key or field name.
      - `value` string — The metadata value or description.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)