# Recorded Future Documentation

> Recorded Future API documentation

This file lists one part of the documentation. The full index is at https://docs.recordedfuture.com/llms.txt.

## API Documentation: Alerts
- Search & Management
  - [Search for Playbook Alerts](https://docs.recordedfuture.com/reference/playbook-alerts-search.md): Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's…
  - [Preview Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-preview.md): Returns a Playbook Alert representation containing only properties shared between all alert types.
  - [Update Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-update.md): Update a Playbook Alert. Generic alert properties like status, priority and assignee may be updated, or a log message may be appended.
  - [Available assignees](https://docs.recordedfuture.com/reference/playbook-alerts-assignees.md): List all users that are available as possible assignees for a given Playbook Alert
  - [Enumerations](https://docs.recordedfuture.com/reference/playbook-alerts-metadata.md): List all metadata and enumerations common to all types of Playbook Alerts.
- Domain Abuse
  - [Detailed Domain Abuse alert data](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-detail.md): Retrieve detailed information about a Domain Abuse Playbook Alert with data grouped into UI-ready panels.
  - [Bulk Domain Abuse alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
  - [Screenshot related to Domain Abuse alert](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-image.md): Fetch a screenshot associated with the Domain Abuse alert.
- Malicious Sites
  - [Playbook Alerts: Malicious Sites Detail](https://docs.recordedfuture.com/reference/post_malicious-sites-playbook-alert-id.md): Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels.
  - [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites.md): Batch-retrieve detailed intelligence for up to 250 Malicious Sites alerts in a single request.
  - [Playbook Alerts: Malicious Sites Screenshot](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id.md): Fetch a screenshot associated with the Malicious Sites alert.
  - [Playbook Alerts: Malicious Sites Create](https://docs.recordedfuture.com/reference/post_malicious-sites-create.md): Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request.  If the…
- Vulnerability
  - [Detailed Vulnerability alert data](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-detail.md): Retrieve detailed information about a Vulnerability Playbook Alert with data grouped into UI-ready panels.
  - [Bulk Vulnerability alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- Data Leakage on Code Repository
  - [Detailed Code Repository Data Leakage alert data](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-detail.md): Retrieve detailed information about a Code Repository Data Leakage Playbook Alert with data grouped into UI-ready panels.
  - [Bulk Code Repository Data Leakage alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- Third Party Risk
  - [Third Party Risk alert data](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-detail.md): Retrieve detailed information about a Third Party Risk Playbook Alert with data grouped into UI-ready panels.
  - [Bulk Third Party Risk alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-bulk.md): Perform a detailed lookup of data panels for several alerts at once.
- Identity Novel Exposures
  - [Detailed Identity Novel Exposures alert data](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-detail.md): Retrieve detailed information about a Identity Novel Exposures Playbook Alert with data grouped into UI-ready panels.
  - [Bulk Identity Novel Exposures alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-bulk.md): Perform a detailed lookup of data panels for several Identity Novel Exposures alerts at once.
- Geopolitics Facility
  - [Bulk Geopolitics Facility alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-bulk.md): Perform a detailed lookup of data panels for several Geopolitics Facility alerts at once.
  - [Geopolitics Facility alert data](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-detail.md): Retrieve detailed information about a Geopolitics Facility with data grouped into UI-ready panels.
  - [Image content by image id](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-image.md): Fetch an image content by image id
- Malware Intelligence
  - [Malware Report alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-detail.md): Retrieve detailed information about a Malware report notification with data grouped into UI-ready panels.
  - [Bulk Malware Report alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-bulk.md): Retrieve detailed information about multiple Malware Report notifications with data grouped into UI-ready panels.
- Payment Card Fraud
  - [Compromised Bank Checks alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-detail.md): Retrieve detailed information about a compromised bank check notification with data grouped into UI-ready panels.
  - [Bulk Compromised Bank Checks alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-bulk.md): Retrieve detailed information about multiple compromised bank check notifications with data grouped into UI-ready panels.
  - [Check image by alert id](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-image.md): Fetch a compromised bank check image content by alert id
- Dark Web Brand
  - [Playbook Alerts: Dark Web Brand Detail](https://docs.recordedfuture.com/reference/post_dark-web-brand-playbook-alert-id.md): Retrieve detailed information about a Dark Web Brand Playbook Alert with data grouped into UI-ready panels.
  - [Playbook Alerts: Dark Web Brand Bulk](https://docs.recordedfuture.com/reference/post_dark-web-brand.md): Retrieve detailed intelligence for multiple Dark Web Brand alerts in a single request, with data grouped into UI-ready panels.
- Social Media Impersonation
  - [Playbook Alerts: Social Media Impersonation Detail](https://docs.recordedfuture.com/reference/post_social-media-impersonation-playbook-alert-id.md): Retrieve detailed information about a Social Media Impersonation Playbook Alert with data grouped into UI-ready panels.
  - [Playbook Alerts: Social Media Impersonation Bulk](https://docs.recordedfuture.com/reference/post_social-media-impersonation.md): Retrieve detailed intelligence for multiple Social Media Impersonation alerts in a single request, with data grouped into UI-ready panels.
- Cases
  - [Build a Case around a Reference Alert, or a Signal Alert](https://docs.recordedfuture.com/reference/cases-create.md): Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation.
  - [Deletes one Case](https://docs.recordedfuture.com/reference/cases-delete.md): Permanently remove a single case by its ID (idempotent — already-deleted or non-existent cases return success).
  - [Deletes specified Cases](https://docs.recordedfuture.com/reference/cases-delete-many.md): Bulk-delete up to 100 cases by ID, with partial-success handling that distinguishes deleted from already-removed cases.
  - [Lookup of Cases using Case IDs](https://docs.recordedfuture.com/reference/cases-lookup-many.md): Retrieve full case details (metadata, alert context, activity history) for one or more cases by their IDs.
  - [Lookup a Case using its ID](https://docs.recordedfuture.com/reference/cases-lookup.md): Retrieve full case details for a single case by ID (known routing bug — prefer POST /lookup with a single ID instead).
  - [Searches for any Case matching the criteria](https://docs.recordedfuture.com/reference/cases-search.md): Search cases by filter criteria to get matching case IDs, which can then be passed to the lookup endpoint for full details.
  - [Update Assignee, Status, Priority, Title or Description of a Case](https://docs.recordedfuture.com/reference/cases-update.md): Update assignee, status, priority, title, or description on an existing case.
  - [Retrieve all eligible assignees for a Case](https://docs.recordedfuture.com/reference/cases-eligible-assignees.md): List users in an organization who are eligible to be assigned to a specific case, with optional name or email filtering.