RErecordedfuture
Analyst Note

Search for Analyst Notes

Search published analyst notes from your enterprise and Insikt Group.

post/search

Request

  • Base URL
    https://api.recordedfuture.com/analyst-note
  • URL
    https://api.recordedfuture.com/analyst-note/search
  • Auth
    • API key in header X-RFToken
    • or OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token

Request body

publishedstring

Notes published after this date, absolute like 2024-01-01 or relative like -3d.

entitystring

Entity id

topicstring

Topic entity id, see list of available ones for details.

titlestring
labelstring
sourcestring

Entity id for note source.

tagged_textboolean

Determines if the <entity></entity> tags should be inline with entities in the note title and text.

escape_htmlboolean

Determines if HTML tags are escaped, applied only when tagged_text = true.

serialization'id' | 'min' | 'full'

Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type and possibly a description included in the response.

limitinteger

Maximum number of references from which notes are fetched, at most 1000.

fromstring

Offset the result based on next_offset from a previous search response

enterprise_onlyboolean

When true, restricts results to notes authored by your organization (excludes Insikt Group notes).

Example request

{
  "topic": "h4G-3N",
  "source": "source:VKz42X"
}

Response

A list of notes matching the search criteria.

next_offsetstring

Example response

{
  "data": [
    {
      "attributes": {
        "validated_on": "2025-03-21T12:00:00.000Z",
        "diamond_model": [
          {
            "start": "2024-01-01T13:00:00Z",
            "stop": "2024-01-02T13:00:00Z",
            "adversary": [
              {
                "id": "Lwv8pC",
                "type": "Organization",
                "name": "Sandworm Team"
              }
            ],
            "target": [
              {
                "id": "DmPaB",
                "type": "Industry",
                "name": "Energy and Natural Resources"
              }
            ],
            "malicious_infrastructure": [
              {
                "id": "ip:185.220.101.58",
                "type": "IpAddress",
                "name": "185.220.101.58"
              }
            ]
          }
        ]
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.