---
title: "Lookup a IP Address entity by id by querying an Intelligence Card extension"
method: GET
path: "/ip/{id}/extension/{extension}"
tags: ["IP"]
---

# Lookup a IP Address entity by id by querying an Intelligence Card extension

`GET /ip/{id}/extension/{extension}`

Get third-party enrichment for an IP from extensions like Shodan, GreyNoise, Censys, or VirusTotal.

## Path parameters

- `id` string, required
- `extension` 'CarbonBlack' | 'Censys' | 'GreyNoiseIntelligence' | 'Kaspersky_Threat_Intelligence_Portal' | 'SentinelOne' | 'ThreatConnect' | 'active_ip_geo' | 'active_ip_history' | 'alienvault' | 'cisco_umbrella' | 'domaintools_iris' | 'dragos' | 'dt' | 'facebookte' | 'farsight' | 'inquest' | 'mandiant' | 'multirbl' | 'nucleon' | 'nucleon' | 'phishme' | 'reversinglabs' | 'riskig' | 'scanner_ip' | 'servicenow' | 'shodan' | 'virustotal' | 'virustotal_widget' | 'xforce', required

## Query parameters

- `metadata` unknown

## Response `200`

Result of operation

- ExtensionResponse — Extension data for an entity. The structure varies by extension type (e.g., relatedEntities, metrics, riskyCIDRIPs).
  - `data` object — Extension-specific data. Structure depends on the extension requested.
  - `metadata` object — Request metadata (included when metadata=true).

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)