---
title: "Search for alert rules."
method: GET
path: "/rule"
tags: ["Alert"]
---

# Search for alert rules.

`GET /rule`

## Request

- Base URL: `api.recordedfuture.com/alert/v2` (relative, and the document’s source URL is not known)
- URL: `api.recordedfuture.com/alert/v2/rule`
- Auth: API key in header `X-RFToken`

Search for alert rules based on a set of filters.

## Query parameters

- `freetext` string
- `limit` integer
- `taggedText` boolean

## Response `200`

List of alert rule definitions matching the search criteria

- AlertRuleSearchResponseV2
  - `data` object, required
    - `results` AlertRule[], required
      - `id` string, required: Id of the alert rule
      - `title` string, required: Title of the alert rule
      - `created` string, date-time, required: Creation date of the alert rule
      - `enabled` boolean, required: Whether the alert rule is enabled
      - `priority` boolean, required: Whether the rule is a priority rule
      - `tags` string[], required: Deprecated. Always empty.
      - `use_case_id` string, nullable, required: Id of the rule's use case. `null` for custom rules.
      - `owner` IdName: A generic id/name reference (user, organisation, subscriber or intelligence goal)
        - `id` string, required: Entity id, format varies by entity type
        - `name` string, required: Entity display name
      - `intelligence_goals` IdName[], required: Intelligence goals that the alert rule is associated with
        - `id` string, required: Entity id, format varies by entity type
        - `name` string, required: Entity display name
      - `notification_settings` object, required: Notification settings for the rule
        - `email_subscribers` IdName[], required: A list of email subscribers for the rule
          - `id` string, required: Entity id, format varies by entity type
          - `name` string, required: Entity display name
        - `mobile_subscribers` IdName[], required: A list of mobile subscribers for the rule
          - `id` string, required: Entity id, format varies by entity type
          - `name` string, required: Entity display name
  - `counts` Counts, required
    - `returned` integer, required: Number of alerts returned
    - `total` integer, required: Total number of alerts matching the query

## Changes

- **2026-11-03** `46a67c0859e1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/recordedfuture/apis/alert-api/changes/rule/get.md)

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/alert-api/revisions/46a67c0859e1?raw)