---
title: "Search for Analyst Notes"
method: POST
path: "/search"
tags: ["Analyst Note"]
---

# Search for Analyst Notes

`POST /search`

## Request

- Base URL: `https://api.recordedfuture.com/analyst-note`
- URL: `https://api.recordedfuture.com/analyst-note/search`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Search published analyst notes from your enterprise and Insikt Group.

## Request body

- SearchRequest
  - `published` string: Notes published after this date, absolute like 2024-01-01 or relative like -3d.
  - `entity` string: Entity id
  - `topic` string: Topic entity id, see [list](https://docs.recordedfuture.com/reference/analyst-note-available-topics) of available ones for details.
  - `title` string
  - `label` string
  - `source` string: Entity id for note source.
  - `tagged_text` boolean: Determines if the `<entity></entity>` tags should be inline with entities in the note title and text.
  - `escape_html` boolean: Determines if HTML tags are escaped, applied only when `tagged_text = true`.
  - `serialization` 'id' | 'min' | 'full': Entity serialization level. When set to `id`, only the entity id will be included. Setting it to `min` leads to the id and name being included and setting it to `full` means that each entity will have the id, name, type and possibly a description included in the response.
  - `limit` integer: Maximum number of references from which notes are fetched, at most 1000.
  - `from` string: Offset the result based on next_offset from a previous search response
  - `enterprise_only` boolean: When true, restricts results to notes authored by your organization (excludes Insikt Group notes).

## Response `200`

A list of notes matching the search criteria.

- SearchResponse
  - `data` object[], required
    - `attributes` NoteSearchResponseAttributes
      - `title` string, required
      - `text` string, required
      - `published` string, date-time, required
      - `note_entities` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `context_entities` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `topic` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `labels` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `validation_urls` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `validated_on` string, date-time: Date when analyst note was validated
      - `diamond_model` DiamondModel[]
        - `start` string, date-time
        - `stop` string, date-time
        - `malicious_infrastructure` NoteEntity[]
          - `id` string, required
          - `name` string
          - `type` string
          - `description` string
        - `capabilities` NoteEntity[]
          - `id` string, required
          - `name` string
          - `type` string
          - `description` string
        - `adversary` NoteEntity[]
          - `id` string, required
          - `name` string
          - `type` string
          - `description` string
        - `target` NoteEntity[]
          - `id` string, required
          - `name` string
          - `type` string
          - `description` string
      - `header_image` NoteEntity
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
      - `recommended_queries` Query[]
        - `title` string
        - `url` NoteEntity
          - `id` string, required
          - `name` string
          - `type` string
          - `description` string
      - `attachment` string: attachment file name
      - `detection_rules` NoteEntity[]
        - `id` string, required
        - `name` string
        - `type` string
        - `description` string
    - `id` string, required: Note id
    - `source` NoteEntity, required
      - `id` string, required
      - `name` string
      - `type` string
      - `description` string
  - `next_offset` string
  - `counts` object, required
    - `returned` integer, required
    - `total` integer, required

---

[API](https://skmtc.dev/recordedfuture/apis/analyst-note-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/analyst-note-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/analyst-note-api/revisions/59d72deace17?raw)