Recorded Future · Schema
UrlLookupResponse
URL enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested.
CybersecurityThreat IntelligenceIntelligence CloudBrand IntelligenceIdentity IntelligenceVulnerability IntelligenceAI Analyst
Properties
| Name | Type | Description |
|---|---|---|
| data | object | URL entity data with requested enrichment fields. |
| metadata | object | Request metadata. Included when the metadata query parameter is set to true. |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-url-lookup-response-schema.json",
"title": "UrlLookupResponse",
"description": "URL enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested.",
"x-generated": "2026-10-20",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/recorded-future-connect-api-openapi.yml#/components/schemas/UrlLookupResponse",
"type": "object",
"properties": {
"data": {
"type": "object",
"description": "URL entity data with requested enrichment fields.",
"properties": {
"entity": {
"$ref": "#/$defs/Entity"
},
"risk": {
"$ref": "#/$defs/RiskData"
},
"aiInsights": {
"$ref": "#/$defs/AiInsights"
},
"links": {
"$ref": "#/$defs/LinksData"
},
"intelCard": {
"type": "string",
"format": "uri",
"description": "URL to the Recorded Future Intelligence Card for this URL entity."
},
"sightings": {
"type": "array",
"description": "Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'.",
"items": {
"$ref": "#/$defs/Sighting"
}
},
"threatLists": {
"type": "array",
"description": "Curated threat list memberships.",
"items": {
"$ref": "#/$defs/ThreatList"
}
},
"riskMapping": {
"type": "array",
"description": "Risk rule to MITRE ATT&CK mapping.",
"items": {
"$ref": "#/$defs/RiskMapping"
}
},
"timestamps": {
"$ref": "#/$defs/Timestamps"
},
"analystNotes": {
"type": "array",
"description": "Insikt Group analyst notes providing expert analysis and context.",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "Unique identifier for this analyst note."
},
"attributes": {
"type": "object",
"description": "Content and metadata of the analyst note.",
"properties": {
"title": {
"type": "string",
"description": "Title of the analyst note."
},
"text": {
"type": "string",
"description": "Full text content of the analyst note."
},
"validated_on": {
"type": "string",
"format": "date-time",
"description": "Date when the note was last validated."
},
"published": {
"type": "string",
"format": "date-time",
"description": "Date when the note was published."
},
"topic": {
"type": "object",
"description": "The topic category of this note.",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
},
"description": {
"type": "string"
}
}
},
"context_entities": {
"type": "array",
"description": "Entities referenced as context in the note.",
"items": {
"$ref": "#/$defs/Entity"
}
},
"note_entities": {
"type": "array",
"description": "Primary subject entities of the note.",
"items": {
"$ref": "#/$defs/Entity"
}
},
"validation_urls": {
"type": "array",
"description": "URLs used to validate the note.",
"items": {
"$ref": "#/$defs/Entity"
}
}
}
},
"source": {
"type": "object",
"description": "Source of the analyst note.",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
}
}
}
}
}
},
"relatedEntities": {
"type": "array",
"description": "Co-occurrence relationships grouped by entity type (not editorially validated).",
"items": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Relationship type category (e.g., RelatedIpAddress, RelatedHash, RelatedMalware, RelatedThreatActor)."
},
"entities": {
"type": "array",
"description": "Related entities ordered by co-occurrence count.",
"items": {
"type": "object",
"properties": {
"count": {
"type": "integer",
"description": "Number of co-occurrences."
},
"entity": {
"$ref": "#/$defs/Entity"
}
}
}
}
}
}
},
"counts": {
"type": "array",
"description": "Daily reference count time-series.",
"items": {
"type": "object",
"properties": {
"date": {
"type": "string",
"format": "date",
"description": "The date for this reference count."
},
"count": {
"type": "integer",
"description": "Number of references on this date."
}
}
}
},
"metrics": {
"type": "array",
"description": "Flat metric counters for aggregate statistics.",
"items": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Metric type identifier (e.g., linkedToCyberExploit, linkedToRAT)."
},
"value": {
"type": "integer",
"description": "The metric count value."
}
}
}
},
"enterpriseLists": {
"type": "array",
"description": "Enterprise-specific list memberships.",
"items": {
"type": "object"
}
}
}
},
"metadata": {
"type": "object",
"description": "Request metadata. Included when the metadata query parameter is set to true."
}
},
"required": [
"data"
],
"$defs": {
"AiInsights": {
"type": "object",
"description": "AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered.",
"properties": {
"text": {
"type": [
"string",
"null"
],
"description": "AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered."
},
"numberOfReferences": {
"type": "integer",
"description": "Number of intelligence references used to generate the insight."
},
"comment": {
"type": [
"string",
"null"
],
"description": "Explanatory comment (e.g., why insights are not available)."
}
}
},
"Entity": {
"type": "object",
"description": "Recorded Future entity identification.",
"properties": {
"id": {
"type": "string",
"description": "Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:<value>, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies."
},
"name": {
"type": "string",
"description": "Human-readable entity name."
},
"type": {
"type": "string",
"description": "Entity type classification.",
"enum": [
"IpAddress",
"InternetDomainName",
"Hash",
"URL",
"CyberVulnerability",
"Malware",
"Company"
]
},
"description": {
"type": "string",
"description": "Entity description (present for vulnerabilities and some other types)."
}
},
"required": [
"id",
"name",
"type"
]
},
"EvidenceDetail": {
"type": "object",
"description": "Evidence for a triggered risk rule, including the rule name, severity, and supporting evidence string.",
"properties": {
"rule": {
"type": "string",
"description": "Risk rule name that was triggered."
},
"criticality": {
"type": "integer",
"description": "Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious)."
},
"criticalityLabel": {
"type": "string",
"description": "Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.",
"enum": [
"Informational",
"Unusual",
"Suspicious",
"Moderate",
"Malicious",
"High",
"Very Malicious",
"Very High"
]
},
"evidenceString": {
"type": "string",
"description": "Human-readable evidence summary with source references and sighting details."
},
"mitigationString": {
"type": "string",
"description": "Recommended mitigation or remediation guidance for this risk rule."
},
"timestamp": {
"type": "string",
"format": "date-time",
"description": "ISO 8601 timestamp of when the evidence was observed."
}
}
},
"LinksData": {
"type": "object",
"description": "Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships.",
"properties": {
"hits": {
"type": "array",
"description": "Intelligence hits containing sectioned relationship data.",
"items": {
"type": "object",
"properties": {
"start_date": {
"type": "string",
"description": "Start date of the intelligence hit time window."
},
"stop_date": {
"type": "string",
"description": "End date of the intelligence hit time window."
},
"total_count": {
"type": "integer",
"description": "Total number of entity relationships in this hit."
},
"sample_reference_ids": {
"type": "array",
"description": "Sample reference IDs supporting this hit.",
"items": {
"type": "string"
}
},
"counts": {
"type": "array",
"description": "Breakdown counts by entity type.",
"items": {
"type": "object",
"properties": {
"count": {
"type": "integer",
"description": "Number of entities."
},
"type": {
"type": "object",
"description": "Entity type metadata.",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
}
}
}
}
}
},
"event_count": {
"type": "integer",
"description": "Number of events in this hit."
},
"sections": {
"type": "array",
"description": "Relationship sections grouped by category.",
"items": {
"type": "object",
"properties": {
"section_id": {
"type": "object",
"description": "Section identifier.",
"properties": {
"id": {
"type": "string",
"description": "Section ID."
},
"name": {
"type": "string",
"description": "Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules')."
},
"type": {
"type": "string",
"description": "Section type (e.g., 'Category')."
}
}
},
"total_count": {
"type": "integer",
"description": "Total entities in this section."
},
"lists": {
"type": "array",
"description": "Entity lists within this section, grouped by entity type.",
"items": {
"type": "object",
"properties": {
"entities": {
"type": "array",
"items": {
"$ref": "#/$defs/LinksEntity"
}
},
"total_count": {
"type": "integer",
"description": "Total entities in this list."
},
"type": {
"type": "object",
"description": "Entity type metadata for this list.",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
},
"description": {
"type": "string"
}
}
}
}
}
}
}
}
}
}
}
},
"method_aggregates": {
"type": "array",
"description": "Aggregated counts of linked entities by analysis method.",
"items": {
"type": "object",
"properties": {
"count": {
"type": "integer",
"description": "Number of links found by this method."
},
"type": {
"type": "string",
"description": "Analysis method type."
}
}
}
},
"counts": {
"type": "array",
"description": "Summary counts of linked entities by type.",
"items": {
"type": "object",
"properties": {
"count": {
"type": "integer",
"description": "Number of linked entities of this type."
},
"type": {
"type": "object",
"description": "Entity type metadata.",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
},
"description": {
"type": "string"
}
}
}
}
}
}
}
},
"LinksEntity": {
"type": "object",
"description": "An entity referenced in a validated intelligence link.",
"properties": {
"id": {
"type": "string",
"description": "Recorded Future entity ID."
},
"name": {
"type": "string",
"description": "Entity display name."
},
"type": {
"type": "string",
"description": "Entity type (e.g., MitreAttackIdentifier, Malware, ThreatActor, Company, IpAddress)."
}
}
},
"RiskData": {
"type": "object",
"description": "Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities.",
"properties": {
"score": {
"type": "integer",
"description": "Numeric risk score from 0 (no risk) to 99 (critical risk).",
"minimum": 0,
"maximum": 99
},
"criticality": {
"type": "integer",
"description": "Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious)."
},
"criticalityLabel": {
"type": "string",
"description": "Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.",
"enum": [
"None",
"Informational",
"Unusual",
"Suspicious",
"Moderate",
"Malicious",
"High",
"Very Malicious",
"Very High"
]
},
"riskString": {
"type": "string",
"description": "Triggered vs total risk rules (e.g., '16/81')."
},
"rules": {
"type": "integer",
"description": "Number of currently triggered risk rules."
},
"riskSummary": {
"type": "string",
"description": "Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.')."
},
"evidenceDetails": {
"type": "array",
"description": "Evidence for each triggered risk rule.",
"items": {
"$ref": "#/$defs/EvidenceDetail"
}
}
}
},
"RiskMapping": {
"type": "object",
"description": "Mapping of triggered risk rules to MITRE ATT&CK techniques and other frameworks.",
"properties": {
"rule": {
"type": "string",
"description": "Risk rule name."
},
"categories": {
"type": "array",
"description": "Framework categories this rule maps to.",
"items": {
"type": "object",
"properties": {
"framework": {
"type": "string",
"description": "Framework name (e.g., 'MITRE ATT&CK')."
},
"name": {
"type": "string",
"description": "Category or technique name."
}
}
}
}
}
},
"Sighting": {
"type": "object",
"description": "An intelligence sighting from a specific source.",
"properties": {
"source": {
"type": "string",
"description": "Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum')."
},
"url": {
"type": "string",
"format": "uri",
"description": "URL to the original source."
},
"published": {
"type": "string",
"format": "date-time",
"description": "ISO 8601 timestamp of when the sighting was published."
},
"fragment": {
"type": "string",
"description": "Text fragment from the source mentioning the entity."
},
"title": {
"type": "string",
"description": "Title of the source document."
},
"type": {
"type": "string",
"description": "Sighting category.",
"enum": [
"recentDarkWeb",
"recentPaste",
"recentInfoSec",
"recentSocialMedia",
"mostRecent",
"first"
]
}
}
},
"ThreatList": {
"type": "object",
"description": "A curated threat intelligence list membership.",
"properties": {
"id": {
"type": "string",
"description": "Threat list entity ID."
},
"name": {
"type": "string",
"description": "Threat list name."
},
"type": {
"type": "string",
"description": "Entity type (e.g., 'EntityList')."
},
"description": {
"type": "string",
"description": "Description of the threat list and its purpose."
}
}
},
"Timestamps": {
"type": "object",
"description": "First and last seen timestamps for the entity in Recorded Future data.",
"properties": {
"firstSeen": {
"type": "string",
"format": "date-time",
"description": "ISO 8601 timestamp of first observation."
},
"lastSeen": {
"type": "string",
"format": "date-time",
"description": "ISO 8601 timestamp of most recent observation."
}
}
}
}
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/recorded-future-url-lookup-response"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.