---
title: "Lookup a Vulnerability entity by id by querying an Intelligence Card extension"
method: GET
path: "/vulnerability/{id}/extension/{extension}"
tags: ["Vulnerability"]
---

# Lookup a Vulnerability entity by id by querying an Intelligence Card extension

`GET /vulnerability/{id}/extension/{extension}`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/vulnerability/{id}/extension/{extension}`
- Auth: API key in header `X-RFToken`

Get third-party enrichment for a vulnerability from extensions like EPSS, ReversingLabs, or AlienVault.

## Path parameters

- `id` string, required
- `extension` 'EVEClient' | 'reversinglabs' | 'alienvault' | 'shodan' | 'bitsight' | 'xforce' | 'epss' | 'facebookte' | 'mandiant', required

## Query parameters

- `metadata` unknown

## Response `200`

Result of operation

- ExtensionResponse: Extension data for an entity. The structure varies by extension type (e.g., relatedEntities, metrics, riskyCIDRIPs).
  - `data` object: Extension-specific data. Structure depends on the extension requested.
  - `metadata` object: Request metadata (included when metadata=true).

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)