Recorded Future
Recorded Future is a threat intelligence platform whose Intelligence Cloud combines open-web, dark-web, technical, and customer telemetry sources via the Intelligence Graph, indexed and analyzed by Insikt Group analysts and AI. The platform spans Threat Intelligence, Brand Intelligence, Identity Intelligence, SecOps Intelligence, Vulnerability Intelligence, Attack Surface Intelligence, Payment Fraud Intelligence, and Geopolitical Intelligence, plus Cyber Daily and the AI Analyst. Recorded Future exposes a REST API at api.recordedfuture.com (commonly called ConnectAPI) that customers and integration partners use to pull indicators, entities, alerts, and risk scores into SIEMs, SOARs, TIPs, and custom security workflows. Named a Leader in the 2026 Gartner Magic Quadrant for Cyberthreat Intelligence Technologies.
More than an index entry, but the surface is still mostly links rather than artifacts — the cohort most likely to move a full band from modest, well-targeted work.
API Evangelist profiles Recorded Future the way a machine reads it — 31 machine-readable artifacts across 1 API, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Recorded Future scores 26.8/100 (emerging), with a separate agent-readiness read of 7/100 (human only). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Recorded Future
Each block below is one kind of artifact we hold for Recorded Future. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 1
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Recorded Future Intelligence Cloud API
The Recorded Future Intelligence Cloud REST API (api.recordedfuture.com) provides programmatic access to threat intelligence sourced from over a million open-web, dark-web, tech...
Pricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Recorded Future Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Recorded Future Finops
FINOPSFeatures 13
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Intelligence Cloud
Unified intelligence platform delivering prioritized, organization-specific intelligence
Intelligence Graph
Core graph data structure indexing and analyzing 1M+ open-web, dark-web, technical, and telemetry sources
Threat Intelligence
Tactical, operational, and strategic threat intelligence on actors, malware, TTPs, and indicators
Brand Intelligence
Detection of brand impersonation, typosquatting, and digital risk to corporate brands
Identity Intelligence
Monitoring of leaked credentials, identity exposures, and credential compromise events
SecOps Intelligence
Intelligence purpose-built for SOC workflows, alerting, and triage
Vulnerability Intelligence
Vulnerability risk scoring, exploit chatter, and prioritization for patching decisions
Attack Surface Intelligence
Continuous discovery and monitoring of external-facing assets and exposures
Payment Fraud Intelligence
Intelligence on stolen cards, fraud actors, and dark-web payment fraud markets
Geopolitical Intelligence
Geopolitical and physical security intelligence for global operations
AI Analyst
Generative AI assistant that summarizes intelligence and accelerates analyst workflows
Cyber Daily
Daily curated digest of the global threat landscape
Insikt Group
In-house intelligence research and analyst team producing finished intelligence
Scroll within the panel for all 13 ·
Security Posture 2
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Use Cases 6
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
SOC Alert Triage
Enrich SIEM and SOAR alerts with risk scores and entity context from the Intelligence Cloud
Vulnerability Management
Prioritize CVE remediation using real-world exploit and threat-actor activity
Brand Protection
Detect and respond to brand impersonation, typosquatting, and phishing infrastructure
Identity and Credential Monitoring
Detect leaked credentials and identity exposures for employees and customers
Third-Party Risk
Monitor third-party and supply-chain partners for threat exposure
Geopolitical Risk
Track geopolitical events affecting people, facilities, and operations
Integrations 6
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
SIEM
Out-of-the-box integrations with Splunk, Microsoft Sentinel, Google Chronicle, IBM QRadar, and others
SOAR
Playbook content and integrations for Cortex XSOAR, Splunk SOAR, Tines, Torq, and similar platforms
TIP
Integrations with ThreatConnect, Anomali, and other Threat Intelligence Platforms
Firewalls and Proxies
IOC feeds and blocklists for next-gen firewalls and secure web gateways
Endpoint and EDR
Enrichment integrations with CrowdStrike, Microsoft Defender, SentinelOne, and others
Browser Extension
Recorded Future browser extension surfaces intelligence in any web-based security tool
Resources
Every other property we hold for Recorded Future — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 1
Portal, sign-up, and the first successful call
Documentation 1
Reference material describing how the API behaves
Access & Security 2
Authentication, authorization, and security posture
Operate 2
Status, limits, changes, and where to get help
Commercial 2
Pricing, plans, and the legal terms of use
Company 6
The organization behind the API
Other 1
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/recorded-future · machine-readable index on apis.io