--- title: "Lookup a specific Analyst Note" method: POST path: "/lookup/{note_id}" tags: ["Analyst Note"] --- # Lookup a specific Analyst Note `POST /lookup/{note_id}` ## Request - Base URL: `https://api.recordedfuture.com/analyst-note` - URL: `https://api.recordedfuture.com/analyst-note/lookup/{note_id}` - Auth: one of: - API key in header `X-RFToken` - OAuth 2 - Authorization code: `https://id.recordedfuture.com/authorize` - Token URL: `https://id.recordedfuture.com/token` Retrieve a specific analyst note by its ID with configurable serialization level. ## Path parameters - `note_id` string, required ## Request body - LookupRequest - `tagged_text` boolean: Determines if the `` tags should be inline with entities in the note title and text. - `escape_html` boolean: Determines if HTML tags are escaped, applied only when `tagged_text = true`. - `serialization` 'id' | 'min' | 'full': Entity serialization level. When set to `id`, only the entity id will be included. Setting it to `min` leads to the id and name being included and setting it to `full` means that each entity will have the id, name, type and possibly a description included in the response. ## Response `200` Detailed object of the note. - LookupResponse - `attributes` NoteLookupResponseAttributes, required - `title` string, required - `text` string, required - `published` string, date-time, required - `events` union[] - union - CyberAttackEvent - `type` 'CyberAttack', required - `attributes` CyberAttackEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `adversary` NoteEntity[] - … - `target` NoteEntity[] - … - `capabilities` NoteEntity[] - … - `malicious_infrastructure` NoteEntity[] - … - `operation` NoteEntity[] - … - ArmedConflictEvent - `type` 'ArmedConflict', required - `attributes` ArmedConflictEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `attacker` NoteEntity[] - … - `target` NoteEntity[] - … - `location` NoteEntity[] - … - `event_positions` Position[] - … - ArmsPurchaseSaleEvent - `type` 'ArmsPurchaseSale', required - `attributes` ArmsPurchaseSaleEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `arms_seller` NoteEntity[] - … - `arms_purchaser` NoteEntity[] - … - CoupEvent - `type` 'Coup', required - `attributes` CoupEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `location` NoteEntity[] - … - `event_positions` Position[] - … - DiseaseOutbreakEvent - `type` 'DiseaseOutbreak', required - `attributes` DiseaseOutbreakEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `disease` NoteEntity[] - … - `facility` NoteEntity[] - … - `location` NoteEntity[] - … - `event_positions` Position[] - … - ElectionEvent - `type` 'Election', required - `attributes` ElectionEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `location` NoteEntity[], required - … - `event_positions` Position[] - … - EnvironmentalIssueEvent - `type` 'EnvironmentalIssue', required - `attributes` EnvironmentalIssueEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `environmental_issue` string[], required - `location` NoteEntity[] - … - `event_positions` Position[] - … - ManMadeDisasterEvent - `type` 'ManMadeDisaster', required - `attributes` ManMadeDisasterEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `facility` NoteEntity[] - … - `manmade_disaster` NoteEntity[], required - … - `location` NoteEntity[], required - … - `event_positions` Position[] - … - MilitaryManeuverEvent - `type` 'MilitaryManeuver', required - `attributes` MilitaryManeuverEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `actors` NoteEntity[] - … - `locations` NoteEntity[] - … - `event_positions` Position[] - … - NaturalDisasterEvent - `type` 'NaturalDisaster', required - `attributes` NaturalDisasterEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `natural_disaster` NoteEntity[], required - … - `location` NoteEntity[], required - … - `event_positions` Position[] - … - NuclearMaterialTransactionEvent - `type` 'NuclearMaterialTransaction', required - `attributes` NuclearMaterialTransactionEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `material` string[], required - `location_origin` string[] - `location_destination` string[] - PersonThreatEvent - `type` 'PersonThreat', required - `attributes` PersonThreatEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `threatened` NoteEntity[], required - … - `actor` NoteEntity[] - … - PoliticalEvent - `type` 'PoliticalEvent', required - `attributes` PoliticalEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `location` NoteEntity[], required - … - `event_positions` Position[] - … - RFEVEProtestEvent - `type` 'RFEVEProtest', required - `attributes` RFEVEProtestEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `protest_target` NoteEntity[] - … - `location` NoteEntity[] - … - `event_positions` Position[] - … - PublicSafetyWarningEvent - `type` 'PublicSafetyWarning', required - `attributes` PublicSafetyWarningEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `location` NoteEntity[], required - … - `event_positions` Position[] - … - TerrorIncidentEvent - `type` 'TerrorIncident', required - `attributes` TerrorIncidentEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `locations` NoteEntity[] - … - `event_positions` Position[] - … - RFEVEArmedAssaultEvent - `type` 'RFEVEArmedAssault', required - `attributes` RFEVEArmedAssaultEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `location` NoteEntity[], required - … - `event_positions` Position[] - … - MalwareAnalysisEvent - `type` 'MalwareAnalysis', required - `attributes` MalwareAnalysisEventAttributes, required - `start` string, date-time, required - `stop` string, date-time, required - `malware` NoteEntity[], required - … - `attacker` NoteEntity[] - … - `malicious_infrastructure` NoteEntity[] - … - `ttp` NoteEntity[] - … - `target` NoteEntity[] - … - `exploit` NoteEntity[] - … - `hash` NoteEntity[] - … - `note_entities` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `context_entities` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `topic` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `labels` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `validation_urls` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `validated_on` string, date-time: Date when analyst note was validated - `diamond_model` DiamondModel[] - `start` string, date-time - `stop` string, date-time - `malicious_infrastructure` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `capabilities` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `adversary` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `target` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `header_image` NoteEntity - `id` string, required - `name` string - `type` string - `description` string - `recommended_queries` Query[] - `title` string - `url` NoteEntity - `id` string, required - `name` string - `type` string - `description` string - `attachment` string: attachment file name - `detection_rules` NoteEntity[] - `id` string, required - `name` string - `type` string - `description` string - `id` string, required: Note id - `source` NoteEntity, required - `id` string, required - `name` string - `type` string - `description` string ## Other responses - `404`: Resource not found --- [API](https://skmtc.dev/recordedfuture/apis/analyst-note-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/analyst-note-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/analyst-note-api/revisions/59d72deace17?raw)