--- title: "Geopolitics Facility alert data" method: POST path: "/geopolitics_facility/{playbook_alert_id}" tags: ["Geopolitics Facility"] --- # Geopolitics Facility alert data `POST /geopolitics_facility/{playbook_alert_id}` ## Request - Base URL: `https://api.recordedfuture.com/playbook-alert` - URL: `https://api.recordedfuture.com/playbook-alert/geopolitics_facility/{playbook_alert_id}` - Auth: one of: - API key in header `X-RFToken` - OAuth 2 - Authorization code: `https://id.recordedfuture.com/authorize` - Token URL: `https://id.recordedfuture.com/token` Retrieve detailed information about a Geopolitics Facility with data grouped into UI-ready panels. ## Path parameters - `playbook_alert_id` string, required ## Request body - object - `events_limit` integer - `panels` string[]: Request inclusion of detailed facility alert data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error': Status describing the result of the request. - `status_message` string: Text describing the status, suitable for displaying an error. - `data` GeopoliticsFacilityResponse - `playbook_alert_id` string, required - `panel_status` FacilityStatusPanel: Data structure containing general information about the alert and it's associated entity. - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required: The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `assignee_name` string: Full name of the assignee - `assignee_id` string: ID of the assignee - `created` string, date-time, required: The Creation time of the Playbook Alert - `updated` string, date-time, required: The Update time of the Playbook Alert - `case_rule_id` string, required: The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' | 'Dark Web Brand' | 'Social Media Impersonation': The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required: The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'DarkWebBrand' | 'SocmedImpersonation' | 'Undefined', required: The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string: The Rule name (if defined) that created the Playbook Alert - `creator_name` string: Full name of the Creator of the Playbook Alert - `creator_id` string: Id of the Creator of the Playbook Alert - `owner_id` string: Id of the owner - `owner_name` string: Name of the owner - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `enterprise_id` string: Id of the Enterprise - `enterprise_name` string: Name of the Enterprise - `entity_id` string - `entity_name` string - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `risk_score` integer: Risk score assigned to the entity - `reopen` 'Never' | 'SignificantUpdates': Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `targets` FacilityTarget[], required: A list of facilities associated with the exposure. - `name` string - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` FacilitySummaryPanel: Facility Evidence Summary with assessments - `events` Event[] - `text` string - `source` string - `url` string - `document_id` string - `time` string, date-time - `images` GeopoliticsFacilityEventImage[] - `assessments` FacilityAssessment[] - `name` string - `criticality` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `assessments` FacilityAssessment[] - `name` string - `criticality` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `panel_events_summary` FacilityEventsPanel: Facility Evidence Summary with assessments - `events` FullEvent[] - `translated_text` string - `translate_title` string - `source` string - `url` string - `document_id` string - `time` string, date-time - `images` GeopoliticsFacilityEventImage[] - `assessments` FacilityAssessment[] - `name` string - `criticality` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `assessments` FacilityAssessment[] - `name` string - `criticality` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `panel_overview` FacilityOverviewPanel: Facility alert overview - `event_type` string - `location` string - `location_distance` LocationDistance: Facility location data - `number` number - `unit` string - `facility_name` string - `event_time` string, date-time - `source` string - `ai_insights` string - `most_recent_event` Event: Event of PBA - `text` string - `source` string - `url` string - `document_id` string - `time` string, date-time - `images` GeopoliticsFacilityEventImage[] - `assessments` FacilityAssessment[] - `name` string - `criticality` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `facility_name` string - `facility_id` string - `location_data` LocationData: Facility location data - `latitude` number - `longitude` number - `radius` integer - `watchlist_comment` string - `event_document_id` string - `is_based_on_deleted_event` boolean: If overview data is based on deleted event it returns datetime of deleted event - `deleted_event_time` string: If overview data is based on deleted event it returns datetime of deleted event - `panel_log` object[]: Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates. - `id` string - `actor_name` string: Full name of the author - `actor_id` string: Id of the author - `created` string, date-time - `modified` string, date-time - `action_priority` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `message` string: Log message - `changes` PlaybookAlertLogPanelChanges - `assignee_change` AssigneeChange - `old` string - `new` string - `type` 'assignee_change', required - `status_change` StatusChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `priority_change` PriorityChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - `reopen_strategy_change` ReopenStrategyChange: This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - `title_change` TitleChange: This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - `entities_change` EntitiesChange - `removed` string[] - `added` string[] - `type` 'entities_change', required - `related_entities_change` RelatedEntitiesChange - `removed` string[] - `added` string[] - `type` 'related_entities_change', required - `description_change` DescriptionChange: This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - `external_id_change` ExternalIdChange: This change applies to any alert type. - `old` string - `new` string - `type` 'external_id_change', required - `actions_change` ActionChange: This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - `assessment_ids_change` AssessmentIdsChange: This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - `context` union - DomainAbuseChangeContext - `type` 'domain_abuse', required - `changes` union[], required - union - … - VulnerabilityChangeContext - `type` 'cyber_vulnerability', required - `changes` union[], required - union - … - CodeRepoLeakageChangeContext - `type` 'code_repo_leakage', required - `changes` union[], required - union - … - ThirdPartyRiskChangeContext - `type` 'third_party_risk', required - `changes` union[], required - union - … - FacilityRiskChangeContext - `type` 'geopolitics_facility', required - `changes` union[], required - union - … - `panel_log_v2` object[]: Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string: Id of the author - `author_name` string: Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2: This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange: This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange: This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange: This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange: This change applies to any alert type. - `old` string - `new` string - `type` 'external_id_change', required - CommentChange: This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange: This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange: This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange: This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange: This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded: Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)