--- title: "Search for alerts with extra details" method: GET path: "/search/details" tags: ["Alert (deprecated)"] --- # Search for alerts with extra details `GET /search/details` ## Request - Base URL: `api.recordedfuture.com/alert/v2` (relative, and the document’s source URL is not known) - URL: `api.recordedfuture.com/alert/v2/search/details` - Auth: API key in header `X-RFToken` Search for alerts based on a set of filters. This endpoint includes more data compared to the regular search endpoint. ## Query parameters - `triggered` string - `assignee` string - `status` 'unassigned' | 'assigned' | 'pending' | 'dismiss' | 'no-action' | 'actionable' | 'tuning' - `alertRule` string - `freetext` string - `limit` integer - `from` integer - `taggedText` boolean - `orderby` 'triggered' - `direction` 'asc' | 'desc' ## Response `200` A list of alerts matching the search criteria with extra details - AlertSearchDetailsResponseV2 - `data` object, required - `results` AlertV2Detailed[], required - `id` string, required: Alert id - `title` string, required: Alert title - `type` 'ENTITY' | 'EVENT' | 'REFERENCE' | 'OTHER', required: Alert type - `triggered` string, date-time, required: Timestamp of when the alert was triggered - `url` string, required: Portal URL for the alert - `rule` RuleV2, required: The alert rule that produced the alert - `id` string, required: Rule id - `name` string, required: Rule title, or "No access to alert rule" if the rule cannot be accessed - `url` string, required: Portal URL to view the rule - `owner_id` string, required: Id of the rule owner - `owner_name` string, required: Name of the rule owner - `organisation_id` string, required: Id of the rule owner organisation - `organisation_name` string, required: Name of the rule owner organisation - `use_case_deprecation` UseCaseDeprecation, nullable, required: Deprecation notice for the rule's use case. `null` unless the rule's use case is deprecated and the notice is currently active. - `from` string, date-time, nullable: Date from which the use case is deprecated - `description` string: Human-readable deprecation description - `links` object: Related links keyed by label - `ai_insights` AiInsights, required: Recorded Future AI summary of the alert. `text` and `comment` are mutually exclusive: when a summary is available `text` holds it and `comment` is `null`; otherwise `text` is `null` and `comment` explains why no summary is available. - `text` string, nullable, required: The generated AI summary text. `null` when no summary is available. - `comment` string, nullable, required: Human-readable explanation shown when no summary text is available (for example "Summary is disabled for this alert." or "Summary timed out."). `null` when `text` is populated. - `review` ReviewV2, required: Triage/review information for the alert - `status` 'unassigned' | 'assigned' | 'pending' | 'dismiss' | 'no-action' | 'actionable' | 'tuning' | 'null', nullable, required: Deprecated legacy review status. Use `statusInPortal` instead. `null` when the alert has no review status. - `statusInPortal` 'New' | 'Resolved' | 'Pending' | 'Dismissed' | 'Flag for Tuning' | 'Unknown', required: Alert review status as shown in the portal. Defaults to "Unknown". - `statusDate` string, date-time, nullable, required: When the status was last changed - `statusChangeBy` string, nullable, required: Email of the user who last changed the status - `assignee` string, nullable, required: Email of the assigned user - `note` string, nullable, required: Review note text - `noteAuthor` string, nullable, required: Email of the note author - `noteDate` string, date-time, nullable, required: When the note was last updated - `owner_organisation_details` OwnerOrganisationDetails, required: Details about the owner of the alert's rule and their organisation(s) - `owner_id` string: Id of the owning user. Only present when the owner is an individual user. - `owner_name` string: Name of the owning user. Only present when the owner is an individual user. - `organisations` object[], required: Organisations the alert is shared with. May be empty. - `organisation_id` string, required: Id of the organisation - `organisation_name` string, required: Name of the organisation - `enterprise_id` string, nullable, required: Id of the owner's enterprise - `enterprise_name` string, nullable, required: Name of the owner's enterprise - `counts` AlertCountsV2, required: Per-alert counts of the intelligence that triggered the alert - `documents` integer, required: Number of distinct documents among the visible references - `entities` integer, required: Number of signals/entities - `references` integer, required: Number of visible references - `entities` AlertEntityV2[], required: A list of entities tied to the alert - `entity` Entity, nullable, required: A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity. - `id` string, required: Entity id - `name` string, required: Entity display name - `type` string, required: Entity type Some examples are Malware, InternetDomainName, IpAddress, Hash and Company - `description` string: Entity description. Only present when the entity has a description attribute. - `risk` union, required: Risk information for the entity. Empty for non-risk alerts; individual sub-fields may be `null`. - object - object - `criticality` integer, nullable: Criticality level of the entity - `criticalityLabel` string, nullable: Criticality label of the entity - `score` integer, nullable: Risk score of the entity - `evidence` EvidenceV2[], nullable: List of evidence related to the entity - … - `documents` DocumentV2[], nullable: List of documents related to the entity - … - `trend` union, required: Trend information for the entity. Empty object (`{}`) for non-trend alerts. - object - object - `name` string, nullable, required: The entity's role in the cyber trend - `strength` integer, required: Trend signal strength - `strengthLabel` string, required: Trend strength label - `documents` DocumentV2[], required: List of documents related to the entity - … - `documents` DocumentV2[], required: Documents for event/reference alerts. Usually empty for signal alerts. - `title` string, nullable, required: Title of the document - `url` string, nullable, required: URL of the document - `source` Entity, nullable, required: A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity. - `id` string, required: Entity id - `name` string, required: Entity display name - `type` string, required: Entity type Some examples are Malware, InternetDomainName, IpAddress, Hash and Company - `description` string: Entity description. Only present when the entity has a description attribute. - `authors` Entity[], required: Authors of the document - `id` string, required: Entity id - `name` string, required: Entity display name - `type` string, required: Entity type Some examples are Malware, InternetDomainName, IpAddress, Hash and Company - `description` string: Entity description. Only present when the entity has a description attribute. - `references` ReferenceV2[], required: References tied to the document - `id` string, required: Reference id - `fragment` string, nullable, required: Text fragment summarizing the intelligence match - `language` string, nullable, required: Language of the text fragment - `entities` Entity[], required: Entities tied to the reference - … - `noteId` string, nullable: Analyst note id. Only present for analyst note / Insikt Group sources. - `noteLink` string, nullable: Portal link to the analyst note. Only present for analyst note / Insikt Group sources. - `triggered_by` TriggeredBy[], required: A list of entity path chains showing which entities matched which rules/lists - `reference_id` string, required: Id of the reference that triggered the alert - `entity_path` EntityPathNode[], required: Deprecated. The single, shortest matching entity path. Use `entity_paths` instead. - `entity` Entity, nullable, required: A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity. - `id` string, required: Entity id - `name` string, required: Entity display name - `type` string, required: Entity type Some examples are Malware, InternetDomainName, IpAddress, Hash and Company - `description` string: Entity description. Only present when the entity has a description attribute. - `attribute` object, required - `id` string, required: Id of the attribute connecting this node to the next - `composite_path` string[]: Only present for composite attribute paths - `entity_paths` array[], required: All relevant matching entity paths. Each path is an ordered array of nodes. - EntityPathNode[] - `entity` Entity, nullable, required: A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity. - … - `attribute` object, required - … - `composite_path` string[]: Only present for composite attribute paths - `counts` Counts, required - `returned` integer, required: Number of alerts returned - `total` integer, required: Total number of alerts matching the query ## Changes - **2026-11-03** `46a67c0859e1`: 1 info - endpoint added [Operation history](https://skmtc.dev/recordedfuture/apis/alert-api/changes/search/details/get.md) --- [API](https://skmtc.dev/recordedfuture/apis/alert-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/alert-api/revisions/46a67c0859e1?raw)