---
title: "Get a single active risk rule with enriched evidence"
method: POST
path: "/active/rule"
tags: ["Active Risks"]
---

# Get a single active risk rule with enriched evidence

`POST /active/rule`

## Request

- Base URL: `https://api.recordedfuture.com/risk`
- URL: `https://api.recordedfuture.com/risk/active/rule`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Fetch a single active risk rule for a company with paginated, rule-type-specific enriched evidence (open ports, leaked credentials, vulnerable products).

## Request body

- GetActiveRiskRuleRequest
  - `company` string, required
  - `rule_alias` string, required
  - `limit` integer: Max number of evidence records to return (where supported)
  - `offset` integer: Evidence offset for pagination (where supported)

## Response `200`

A single active risk rule (if active).

- GetActiveRiskRuleResponse
  - `entity` Entity, required
    - `id` string, required: Entity id
    - `provided_id` string, required: Entity id provided in request
    - `type` string, required: Entity type
    - `name` string, required: Entity name
  - `risk_rule` ActiveRiskRule
    - `risk_id` string, required
    - `risk_name` string, required
    - `rule_alias` string, required
    - `criticality` integer, required
    - `evidence` string, required
    - `added` string, date-time
    - `removed` string, date-time, nullable
    - `enriched_evidence` union
      - OpenPortEvidence
        - `evidence_type` 'openPort', required: Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results` object[], required
          - `ip` string, required
          - `port` integer, required
          - `first_seen` string, date-time, required
          - `last_seen` string, date-time, required
        - `next_offset` integer, nullable
      - LeakedCredentialsEvidence
        - `evidence_type` 'credentialDetails', required: Discriminator identifying this evidence type
        - `entity_id` string, required
        - `rule_alias` string, required
        - `total` integer, required
        - `results` object[], required
          - `email` string, required
          - `password` string, required
          - `document_title` string, required
          - `document_publish_date` string, date-time, required
      - ReferenceListEvidence
        - `evidence_type` 'referenceList', required: Discriminator identifying this evidence type
        - `total` integer, required: Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable: Event title
          - `fragment` string, nullable: Event fragment/excerpt
          - `published` string, date-time, required: Event publication date
          - `document_url` string, nullable: URL to the source document
          - `source` string, nullable: Source identifier
      - AttributeEvidence
        - `evidence_type` 'attribute', required: Discriminator identifying this evidence type
        - `value_type` 'domain', required: Type of attribute value
        - `results` object[], required
          - `value` string, required: Domain entity identifier
          - `added` string, date-time, required: Date when the attribute was added
          - `domain_owner` string, nullable: Domain owner entity identifier
      - CompanyIpEvidence
        - `evidence_type` 'companyIp', required: Discriminator identifying this evidence type
        - `total` integer, required
        - `results` object[], required
          - `ip` string, required
          - `ip_risk_rule` string, required
          - `added` string, date-time, required
        - `next_offset` integer, nullable
      - CompanySusceptibleToEvidence
        - `evidence_type` 'companySusceptibleTo', required: Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results` object[], required
          - `cve_id` string, required
          - `ip` string, required
          - `owner` string, required
          - `timestamp` string, date-time, required
        - `next_offset` integer, nullable
      - ProductRiskEvidence
        - `evidence_type` 'productRisk', required: Discriminator identifying this evidence type
        - `total` integer, nullable
        - `results_in_page` integer, required
        - `results` object[], required
          - `domain` string, required
          - `product_identifier` string, required
          - `cve_id` string, nullable: Optional CVE identifier (may be null)
          - `first_seen` string, date-time, required
          - `last_seen` string, date-time, required
          - `product_risk_rule_name` string, required
        - `next_offset` integer, nullable
      - PatternEvidence
        - `evidence_type` 'pattern', required: Discriminator identifying this evidence type
        - `total` integer, required: Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable: Event title
          - `fragment` string, nullable: Event fragment/excerpt
          - `published` string, date-time, required: Event publication date
          - `document_url` string, nullable: URL to the source document
          - `source` string, nullable: Source identifier
      - CyberTrendsEvidence
        - `evidence_type` 'cyberTrends', required: Discriminator identifying this evidence type
        - `total` integer, required: Total count of event evidence items
        - `results` EventRiskEvidenceItem[], required
          - `title` string, nullable: Event title
          - `fragment` string, nullable: Event fragment/excerpt
          - `published` string, date-time, required: Event publication date
          - `document_url` string, nullable: URL to the source document
          - `source` string, nullable: Source identifier

---

[API](https://skmtc.dev/recordedfuture/apis/risk-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/risk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/risk-api/revisions/0c448cd00d5a?raw)