---
title: "Fetch risk information for a set of indicators"
method: POST
path: "/enrichment"
tags: ["Soar"]
---

# Fetch risk information for a set of indicators

`POST /enrichment`

## Request

- Base URL: `https://api.recordedfuture.com/soar/v3`
- URL: `https://api.recordedfuture.com/soar/v3/enrichment`
- Auth: API key in header `X-RFToken`

Retrieve risk scores, triggered rules, and evidence for up to 1,000 indicators across six entity types in a single batch call.

## Query parameters

- `metadata` boolean

## Request body

- EnrichRequest: Entities to be enriched, grouped by type up to a total of 1000 IOCs.
  - `ip` string[]: IPs to enrich
  - `domain` string[]: Domains to enrich
  - `url` string[]: URLs to enrich
  - `hash` string[]: Hashes to enrich
  - `vulnerability` string[]: Vulnerabilities to enrich
  - `companybydomain` string[]: Companies to enrich, identified by their domain name.

## Response `200`

output

- EnrichResponse: Enrichment results with risk scores, evidence, and threat context for submitted entities.
  - `data` EnrichResponseData, required: Data wrapper containing enrichment result entries.
    - `results` object[], required: Individual enrichment result for a single entity.
      - `risk` object, required
        - `score` number, required: Overall risk score for this entity (0-99).
        - `level` number, required: Risk level category (0=None, 1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
        - `context` object, required: Risk context data keyed by context name (e.g., phishing, c2, malware, public). Each key represents a risk context use case.
        - `rule` object, required: Aggregate risk rule data for this entity across all contexts.
          - `summary` object[]: Summary of triggered rules grouped by severity level.
            - `level` number, required: Severity level (1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
            - `count` number, required: Number of rules triggered at this severity level.
          - `mostCritical` string: Name of the most critical (highest severity) rule triggered.
          - `count` integer, required: Total number of risk rules triggered for this entity.
          - `maxCount` integer, required: Maximum number of risk rules available for this entity type.
          - `evidence` object: Evidence data keyed by rule identifier (e.g., spamSiteDetected, historicalThreatListMembership, defanged). Each key is a camelCase rule slug.
      - `entity` object, required
        - `id` string, required
        - `name` string, required
        - `type` string, required
        - `description` string
  - `counts` Counts, required: Pagination counts for list responses.
    - `returned` number, required
    - `total` number, required
  - `metadata` Metadata: Response metadata with additional context about the enrichment operation. Only included when the metadata query parameter is set to true.
    - `entries` object[]: Metadata entries providing additional context about the response data elements.
      - `key` string: The metadata key or field name.
      - `value` string: The metadata value or description.

---

[API](https://skmtc.dev/recordedfuture/apis/soar-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/soar-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/soar-api/revisions/42946e24f836?raw)