> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Relationship Responses

> Interpret bounded relationship pivots between canonical entities and related threat context.

Relationship responses help agents discover pivots. Treat them as connected context, then validate important claims with evidence.

## Response Envelope

`/v2/relationships` returns:

| Field                | Meaning                                                                  |
| -------------------- | ------------------------------------------------------------------------ |
| `status`             | Retrieval status for the request.                                        |
| `input_mode`         | Whether the request used `subject` or `query` mode.                      |
| `resolution`         | Entity resolution context when applicable.                               |
| `subject`            | Resolved or submitted subject context when available.                    |
| `relationship_types` | Relationship categories requested or applied.                            |
| `max_results`        | Requested result limit.                                                  |
| `items`              | Related entities, indicators, techniques, or other relationship records. |
| `next_cursor`        | Pagination cursor when additional results are available.                 |
| `metadata`           | Retrieval metadata, degradation details, and implementation notes.       |

Batch relationship responses use the standard batch envelope described in [Batch responses](/responses/batches).

## Key Fields

Relationship items may include:

* related entity ID and name
* relationship type
* direction or role
* confidence
* supporting evidence references
* pagination cursor fields

## IOC Relationship Expansion

For IOC subjects (`ip`, `domain`, `url`, `hash`, or `email`), `relationship_types: ["ioc"]` returns related indicators from event-correlation context when available. This is the supported path for IOC expansion; `/v2/ioc-assessments` does not return correlated IOCs inline.

IOC subjects can also return `sector` relationships for targeted industries and `country` relationships for targeted countries when that context is available. These pivots are useful for environment relevance, especially when they match a caller-provided sector or operating region.

IOC relationship items use `relationship_type: "ioc"`, `target_entity_type: "ioc"`, and include `metadata.indicator_type` when known. Sector and country relationship items use matching `relationship_type` and `target_entity_type` values. Treat all relationship items as pivots for hunting or blocking review, not proof by themselves.

## How to use Relationships

Use relationships to select the next investigation step:

* Actor links can trigger actor assessments.
* Malware links can trigger malware or generic threat assessment paths.
* IOC links can trigger IOC assessment or blocking review.
* Sector links can support industry relevance.
* Country links can support geography relevance.
* Technique links can guide detection and hunting.

## Caveat

Do not treat a relationship by itself as proof of current exploitation or targeting. Validate high-impact links with evidence.