--- title: "Lookup a URL entity by id" method: GET path: "/url/{id}" tags: ["URL"] --- # Lookup a URL entity by id `GET /url/{id}` Get full URL enrichment including risk scoring, AI threat analysis, and malware family relationships. ## Path parameters - `id` string, required ## Query parameters - `fields` string - `metadata` unknown - `taggedText` boolean - `comment` string ## Response `200` Result of operation - UrlLookupResponse — URL enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested. - `data` object, required — URL entity data with requested enrichment fields. - `entity` Entity - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `risk` RiskData — Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities. - `score` integer — Numeric risk score from 0 (no risk) to 99 (critical risk). - `criticality` integer — Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `riskString` string — Triggered vs total risk rules (e.g., '16/81'). - `rules` integer — Number of currently triggered risk rules. - `riskSummary` string — Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.'). - `evidenceDetails` EvidenceDetail[] — Evidence for each triggered risk rule. - `rule` string — Risk rule name that was triggered. - `criticality` integer — Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `evidenceString` string — Human-readable evidence summary with source references and sighting details. - `mitigationString` string — Recommended mitigation or remediation guidance for this risk rule. - `timestamp` string, date-time — ISO 8601 timestamp of when the evidence was observed. - `aiInsights` AiInsights — AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered. - `text` string, nullable — AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered. - `numberOfReferences` integer — Number of intelligence references used to generate the insight. - `comment` string, nullable — Explanatory comment (e.g., why insights are not available). - `links` LinksData — Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships. - `hits` object[] — Intelligence hits containing sectioned relationship data. - `start_date` string — Start date of the intelligence hit time window. - `stop_date` string — End date of the intelligence hit time window. - `total_count` integer — Total number of entity relationships in this hit. - `sample_reference_ids` string[] — Sample reference IDs supporting this hit. - `counts` object[] — Breakdown counts by entity type. - `count` integer — Number of entities. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `event_count` integer — Number of events in this hit. - `sections` object[] — Relationship sections grouped by category. - `section_id` object — Section identifier. - `id` string — Section ID. - `name` string — Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules'). - `type` string — Section type (e.g., 'Category'). - `total_count` integer — Total entities in this section. - `lists` object[] — Entity lists within this section, grouped by entity type. - `entities` LinksEntity[] - … - `total_count` integer — Total entities in this list. - `type` object — Entity type metadata for this list. - … - `method_aggregates` object[] — Aggregated counts of linked entities by analysis method. - `count` integer — Number of links found by this method. - `type` string — Analysis method type. - `counts` object[] — Summary counts of linked entities by type. - `count` integer — Number of linked entities of this type. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `description` string - `intelCard` string, uri — URL to the Recorded Future Intelligence Card for this URL entity. - `sightings` Sighting[] — Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'. - `source` string — Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum'). - `url` string, uri — URL to the original source. - `published` string, date-time — ISO 8601 timestamp of when the sighting was published. - `fragment` string — Text fragment from the source mentioning the entity. - `title` string — Title of the source document. - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first' — Sighting category. - `threatLists` ThreatList[] — Curated threat list memberships. - `id` string — Threat list entity ID. - `name` string — Threat list name. - `type` string — Entity type (e.g., 'EntityList'). - `description` string — Description of the threat list and its purpose. - `riskMapping` RiskMapping[] — Risk rule to MITRE ATT&CK mapping. - `rule` string — Risk rule name. - `categories` object[] — Framework categories this rule maps to. - `framework` string — Framework name (e.g., 'MITRE ATT&CK'). - `name` string — Category or technique name. - `timestamps` Timestamps — First and last seen timestamps for the entity in Recorded Future data. - `firstSeen` string, date-time — ISO 8601 timestamp of first observation. - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation. - `analystNotes` object[] — Insikt Group analyst notes providing expert analysis and context. - `id` string — Unique identifier for this analyst note. - `attributes` object — Content and metadata of the analyst note. - `title` string — Title of the analyst note. - `text` string — Full text content of the analyst note. - `validated_on` string, date-time — Date when the note was last validated. - `published` string, date-time — Date when the note was published. - `topic` object — The topic category of this note. - `id` string - `name` string - `type` string - `description` string - `context_entities` Entity[] — Entities referenced as context in the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `note_entities` Entity[] — Primary subject entities of the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `validation_urls` Entity[] — URLs used to validate the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `source` object — Source of the analyst note. - `id` string - `name` string - `type` string - `relatedEntities` object[] — Co-occurrence relationships grouped by entity type (not editorially validated). - `type` string — Relationship type category (e.g., RelatedIpAddress, RelatedHash, RelatedMalware, RelatedThreatActor). - `entities` object[] — Related entities ordered by co-occurrence count. - `count` integer — Number of co-occurrences. - `entity` Entity - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `counts` object[] — Daily reference count time-series. - `date` string, date — The date for this reference count. - `count` integer — Number of references on this date. - `metrics` object[] — Flat metric counters for aggregate statistics. - `type` string — Metric type identifier (e.g., linkedToCyberExploit, linkedToRAT). - `value` integer — The metric count value. - `enterpriseLists` object[] — Enterprise-specific list memberships. - `metadata` object — Request metadata. Included when the metadata query parameter is set to true. --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)