---
title: "Lookup a Company entity by id"
method: GET
path: "/company/{id}"
tags: ["Company"]
---

# Lookup a Company entity by id

`GET /company/{id}`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/company/{id}`
- Auth: API key in header `X-RFToken`

Get full company enrichment including risk scoring, triggered-rule evidence, analyst notes, and relationships.

## Path parameters

- `id` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `taggedText` boolean
- `comment` string

## Response `200`

Result of operation

- CompanyLookupResponse: Company enrichment response. Company entities have risk scores but do not support aiInsights or links fields. The response includes only the fields specified in the `fields` query parameter.
  - `data` object, required: Company entity data with requested enrichment fields.
    - `entity` Entity: Recorded Future entity identification.
      - `id` string, required: Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:<value>, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies.
      - `name` string, required: Human-readable entity name.
      - `type` 'IpAddress' | 'InternetDomainName' | 'Hash' | 'URL' | 'CyberVulnerability' | 'Malware' | 'Company', required: Entity type classification.
      - `description` string: Entity description (present for vulnerabilities and some other types).
    - `risk` RiskData: Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities.
      - `score` integer: Numeric risk score from 0 (no risk) to 99 (critical risk).
      - `criticality` integer: Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
      - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
      - `riskString` string: Triggered vs total risk rules (e.g., '16/81').
      - `rules` integer: Number of currently triggered risk rules.
      - `riskSummary` string: Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.').
      - `evidenceDetails` EvidenceDetail[]: Evidence for each triggered risk rule.
        - `rule` string: Risk rule name that was triggered.
        - `criticality` integer: Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `evidenceString` string: Human-readable evidence summary with source references and sighting details.
        - `mitigationString` string: Recommended mitigation or remediation guidance for this risk rule.
        - `timestamp` string, date-time: ISO 8601 timestamp of when the evidence was observed.
    - `intelCard` string, uri: URL to the Recorded Future Intelligence Card for this company.
    - `counts` object[]: Daily reference count time-series. Can be very large (97KB+) for well-known companies.
    - `analystNotes` object[]: Insikt Group analyst notes.
    - `relatedEntities` object[]: Co-occurrence relationships (not editorially validated).
    - `metrics` object[]: Flat metric counters.
  - `metadata` object: Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)