---
title: "Lookup Company by domain"
method: GET
path: "/company/by_domain/{domain}"
tags: ["Company"]
---

# Lookup Company by domain

`GET /company/by_domain/{domain}`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/company/by_domain/{domain}`
- Auth: API key in header `X-RFToken`

Resolve a domain to its associated company entity with risk scoring and threat intelligence enrichment.

## Path parameters

- `domain` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `comment` string

## Response `200`

Result of operation

- CompanyByDomainResponse: Company entity resolved from a domain name, with risk assessment data.
  - `data` object, required: Company entity data resolved from domain lookup.
    - `entity` Entity: Recorded Future entity identification.
      - `id` string, required: Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:<value>, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies.
      - `name` string, required: Human-readable entity name.
      - `type` 'IpAddress' | 'InternetDomainName' | 'Hash' | 'URL' | 'CyberVulnerability' | 'Malware' | 'Company', required: Entity type classification.
      - `description` string: Entity description (present for vulnerabilities and some other types).
    - `risk` RiskData: Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities.
      - `score` integer: Numeric risk score from 0 (no risk) to 99 (critical risk).
      - `criticality` integer: Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
      - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
      - `riskString` string: Triggered vs total risk rules (e.g., '16/81').
      - `rules` integer: Number of currently triggered risk rules.
      - `riskSummary` string: Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.').
      - `evidenceDetails` EvidenceDetail[]: Evidence for each triggered risk rule.
        - `rule` string: Risk rule name that was triggered.
        - `criticality` integer: Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious).
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `evidenceString` string: Human-readable evidence summary with source references and sighting details.
        - `mitigationString` string: Recommended mitigation or remediation guidance for this risk rule.
        - `timestamp` string, date-time: ISO 8601 timestamp of when the evidence was observed.
    - `curated` boolean: Whether this company entity has been editorially curated.
    - `timestamps` Timestamps: First and last seen timestamps for the entity in Recorded Future data.
      - `firstSeen` string, date-time: ISO 8601 timestamp of first observation.
      - `lastSeen` string, date-time: ISO 8601 timestamp of most recent observation.
  - `metadata` object: Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)