Recorded Future Identity API

https://docs.recordedfuture.com/reference/identity-hostname
Admin
Recorded Future Identity API enables security teams to lookup compromised credentials and identity...
Tokens:1,091
Snippets:5
Trust Score:9.7
Update:5 months ago
Show doc for...
Tokens:
Raw
### Servers

Source: https://docs.recordedfuture.com/reference/identity-hostname

The Recorded Future API is available via the following production server endpoint.

```APIDOC
## Servers

### Recorded Future Production Server

- **URL**: https://api.recordedfuture.com
- **Description**: Recorded Future Production Server
```

--------------------------------

### Hostname Lookup

Source: https://docs.recordedfuture.com/reference/identity-hostname

Find credentials compromised from a specific hostname (e.g., internal servers, VPN endpoints).

```APIDOC
## POST /identity/hostname/lookup

### Description
Find credentials compromised from a specific hostname (e.g., internal servers, VPN endpoints).

### Method
POST

### Endpoint
/identity/hostname/lookup

### Request Body
- **hostname** (string) - Required - The hostname to look up.
- **first_downloaded_gte** (string) - Optional - The first date when these credentials were received and indexed by Recorded Future.
- **latest_downloaded_gte** (string) - Optional - The latest date when these credentials were received and indexed by Recorded Future.

### Request Example
{
  "hostname": "example.com",
  "first_downloaded_gte": "2024-01-01T00:00:00Z"
}

### Response
#### Success Response (200)
- **credentials** (array) - A list of compromised credentials.
  - **credential_id** (string) - The unique identifier for the credential.
  - **credential_type** (string) - The type of credential (e.g., username, password).
  - **domain** (string) - The domain associated with the credential.
  - **first_downloaded** (string) - The date the credential was first downloaded.
  - **hostname** (string) - The hostname associated with the credential.
  - **latest_downloaded** (string) - The date the credential was last downloaded.
  - **organization_id** (string) - The organization ID associated with the credential.
  - **password_hash** (string) - The hashed password.
  - **password_plaintext** (string) - The plaintext password.
  - **source** (string) - The source of the credential leak.
  - **username** (string) - The username associated with the credential.

#### Response Example
{
  "credentials": [
    {
      "credential_id": "cred-12345",
      "credential_type": "username",
      "domain": "example.com",
      "first_downloaded": "2023-01-15T10:00:00Z",
      "hostname": "internal.example.com",
      "latest_downloaded": "2024-01-20T12:00:00Z",
      "organization_id": "org-abcde",
      "password_hash": null,
      "password_plaintext": null,
      "source": "data-breach-xyz",
      "username": "admin"
    }
  ]
}

#### Error Response (400)
- **status_code** (integer) - The HTTP status code.
- **message** (string) - A description of the error.
- **trace_id** (string) - A unique identifier for tracing the request.

#### Error Response (401)
- **status_code** (integer) - The HTTP status code.
- **message** (string) - A description of the error.
- **trace_id** (string) - A unique identifier for tracing the request.

#### Error Response (403)
- **status_code** (integer) - The HTTP status code.
- **message** (string) - A description of the error.
- **trace_id** (string) - A unique identifier for tracing the request.

#### Error Response (500)
- **status_code** (integer) - The HTTP status code.
- **message** (string) - A description of the error.
- **trace_id** (string) - A unique identifier for tracing the request.
```

--------------------------------

### Security Schemes

Source: https://docs.recordedfuture.com/reference/identity-hostname

The Recorded Future API supports two primary security schemes: OAuth2 and API Key authentication.

```APIDOC
## Security Schemes

### RecordedFutureOAuth2

- **Type**: oauth2
- **Description**: JWT-based OAuth2 security scheme supporting RFC8725 for OAuth 2.0 Access Tokens.
- **Flows**:
  - **authorizationCode**:
    - **authorizationUrl**: https://id.recordedfuture.com/authorize
    - **tokenUrl**: https://id.recordedfuture.com/token
    - **refreshUrl**: https://id.recordedfuture.com/token
    - **scopes**: {}

### RecordedFutureApiKey

- **Type**: apiKey
- **In**: header
- **Name**: X-RFToken
```
Tokens:
Raw