---
title: "Preview Playbook Alert"
method: GET
path: "/common/{playbook_alert_id}"
tags: ["Common"]
---

# Preview Playbook Alert

`GET /common/{playbook_alert_id}`

## Request

- Base URL: `https://api.recordedfuture.com/playbook-alert`
- URL: `https://api.recordedfuture.com/playbook-alert/common/{playbook_alert_id}`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Returns a Playbook Alert representation containing only properties shared between all alert types.

## Path parameters

- `playbook_alert_id` string, required

## Response `200`

Data of the fetched alert.

- PreviewResponse
  - `status` PlaybookAlertStatusResponse
    - `status_code` 'Ok' | 'Error': Status describing the result of the request.
    - `status_message` string: Text describing the status, suitable for displaying an error.
  - `data` PlaybookAlertPreview
    - `playbook_alert_id` string, required: Unique ID of the Playbook Alert
    - `rule_id` string, required: Unique ID of the Playbook Rule that generated this Playbook Alert. This field is deprecated, use 'alert_rule.id' instead.
    - `alert_rule` PlaybookAlertAlertRule, required
      - `id` string, required: The Rule ID that created the Playbook Alert (without the 'report:' prefix)
      - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'DarkWebBrand' | 'SocmedImpersonation' | 'Undefined', required: The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing.
      - `name` string: The Rule name (if defined) that created the Playbook Alert
    - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required: The status of the Playbook Alert.
    - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert.
    - `reopen` 'Never' | 'SignificantUpdates': Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates
    - `created` string, date-time, required: The Creation time of the Playbook Alert
    - `updated` string, date-time, required: The Update time of the Playbook Alert
    - `category` 'domain_abuse' | 'malicious_sites' | 'cyber_vulnerability' | 'code_repo_leakage' | 'third_party_risk' | 'identity_novel_exposures' | 'geopolitics_facility' | 'dark_web' | 'socmed_impersonation', required
    - `title` string: The title of the Playbook Alert. This field can be filled in several ways: 1. If there is one entity linked to the alert then title will be a name of this entity. 2. If there is multiple entities linked to the alert then title will be a name of the first entity plus number of not shown entities in format " +N". 3. If no entity then it will be a title of the alert itself. 4. If there is no alert title then title will be just empty.
    - `assignee_name` string: Full name of the assignee
    - `assignee_id` string: ID of the assignee
    - `owner_id` string, required: Id of the owner
    - `owner_name` string, required: Name of the owner
    - `organisation_id` string, required: Id of the Organisation
    - `organisation_name` string, required: Name of the Organisation
    - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails, required
      - `organisations` PlaybookAlertOrganisation[]
        - `organisation_id` string: Id of the Organisation
        - `organisation_name` string: Name of the Organisation
      - `enterprise_id` string: Id of the Enterprise
      - `enterprise_name` string: Name of the Enterprise
    - `actions_taken` OnwardActionId[], required

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)