# Recorded Future Playbook Alerts **Canonical:** https://apis.io/apis/recorded-future/playbook-alerts/ **Provider:** Recorded Future — https://apis.io/providers/recorded-future/ **Base URL:** https://api.recordedfuture.com/playbook-alert **Documentation:** https://docs.recordedfuture.com/reference/alerts/llms.txt Recorded Future Playbook Alerts is one of 25 APIs that [Recorded Future](https://apis.io/providers/recorded-future/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. Tagged areas include Threat Intelligence and Cybersecurity. The published artifact set on APIs.io includes an OpenAPI specification, an API reference, and 6 JSON Schemas. A Recorded Future API for Playbook Alerts. The playbook alert API provides programmatic access to Recorded Future playbook alerts. These alerts differ quite a bit from the standard "alerts" generated by Recorded Future, in that they include additional lookups and information that further empower the user to make accurate and timely decisions. Information presented in a playbook alert will also be updated as needed, based on new information or changes in the Recorded Future risk scores based on elapsed time or similar. The API has several generic endpoint, categorized as common, intended as entry points into Playbook Alert data. Most notably there is /search for finding alerts, and resource item endpoints for previewing basic alert data (`GET /common/{id}`), and updating an alert (`PUT /common/{id}`). For more detailed information and evidence there are a set of endpoint for each al ## Operations (32) | Method | Path | Summary | |---|---|---| | POST | `/code_repo_leakage` | Bulk Code Repository Data Leakage alert lookup | | POST | `/code_repo_leakage/{playbook_alert_id}` | Detailed Code Repository Data Leakage alert data | | GET | `/common/{playbook_alert_id}` | Preview Playbook Alert | | PUT | `/common/{playbook_alert_id}` | Update Playbook Alert | | POST | `/compromised_bank_checks` | Bulk Compromised Bank Checks alert lookup | | GET | `/compromised_bank_checks/image/{playbook_alert_id}` | Check image by alert id | | POST | `/compromised_bank_checks/{playbook_alert_id}` | Compromised Bank Checks alert notification data. | | POST | `/dark_web_brand` | Playbook Alerts: Dark Web Brand Bulk | | POST | `/dark_web_brand/{playbook_alert_id}` | Playbook Alerts: Dark Web Brand Detail | | POST | `/domain_abuse` | Bulk Domain Abuse alert lookup | | POST | `/domain_abuse/{playbook_alert_id}` | Detailed Domain Abuse alert data | | GET | `/domain_abuse/{playbook_alert_id}/image/{image_id}` | Screenshot related to Domain Abuse alert | | POST | `/geopolitics_facility` | Bulk Geopolitics Facility alerts lookup | | GET | `/geopolitics_facility/image/{image_id}` | Image content by image id | | POST | `/geopolitics_facility/{playbook_alert_id}` | Geopolitics Facility alert data | | POST | `/identity_novel_exposures` | Bulk Identity Novel Exposures alerts lookup | | POST | `/identity_novel_exposures/{playbook_alert_id}` | Detailed Identity Novel Exposures alert data | | POST | `/malicious_sites` | Playbook Alerts: Malicious Sites Bulk | | POST | `/malicious_sites/create` | Playbook Alerts: Malicious Sites Create | | POST | `/malicious_sites/{playbook_alert_id}` | Playbook Alerts: Malicious Sites Detail | | GET | `/malicious_sites/{playbook_alert_id}/image/{image_id}` | Playbook Alerts: Malicious Sites Screenshot | | POST | `/malware_report` | Bulk Malware Report alert lookup | | POST | `/malware_report/{playbook_alert_id}` | Malware Report alert notification data. | | POST | `/metadata/assignees` | Available assignees | | GET | `/metadata/common` | Enumerations | | POST | `/search` | Search for Playbook Alerts | | POST | `/social_media_impersonation` | Playbook Alerts: Social Media Impersonation Bulk | | POST | `/social_media_impersonation/{playbook_alert_id}` | Playbook Alerts: Social Media Impersonation Detail | | POST | `/third_party_risk` | Bulk Third Party Risk alert lookup | | POST | `/third_party_risk/{playbook_alert_id}` | Third Party Risk alert data | | POST | `/vulnerability` | Bulk Vulnerability alert lookup | | POST | `/vulnerability/{playbook_alert_id}` | Detailed Vulnerability alert data | ## Machine-readable artifacts (8) - **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/openapi/recorded-future-playbook-alerts-api-openapi.yml - **APIReference** — https://docs.recordedfuture.com/reference - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-dark-web-brand-response-schema.json - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-domain-abuse-response-schema.json - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-malicious-sites-create-options-schema.json - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-malicious-sites-response-schema.json - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-metadata-common-schema.json - **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-geopolitics-facility-response-schema.json ## Other Recorded Future APIs (12) - [Recorded Future Intelligence Cloud API](https://apis.io/apis/recorded-future/recorded-future-connect-api/) - [Recorded Future Alert API](https://apis.io/apis/recorded-future/alert/) - [Recorded Future Analyst Note API](https://apis.io/apis/recorded-future/analyst-note/) - [Recorded Future ASI Project API](https://apis.io/apis/recorded-future/asi-project/) - [Recorded Future Autonomous Threat Operations API](https://apis.io/apis/recorded-future/autonomous-threat-operations/) - [Recorded Future Case](https://apis.io/apis/recorded-future/case/) - [Recorded Future Collective Insights API](https://apis.io/apis/recorded-future/collective-insights/) - [Recorded Future Common Platform Enumeration APIs V0](https://apis.io/apis/recorded-future/common-platform-enumeration-apis-v0/) - [Recorded Future Customer APIs V0](https://apis.io/apis/recorded-future/customer-apis-v0/) - [Recorded Future Customer APIs V2](https://apis.io/apis/recorded-future/customer-apis-v2/) - [Recorded Future Detection Rule API](https://apis.io/apis/recorded-future/detection-rule/) - [Recorded Future Detection Rule Relation API](https://apis.io/apis/recorded-future/detection-rule-relation/) ## Tags Threat Intelligence, Cybersecurity --- Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/recorded-future/playbook-alerts/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/recorded-future/.