This reference documents the three serialization levels available for the serialization parameter used across all analyst note operations: Analyst Notes: Preview, Analyst Notes: Publish, Analyst Notes: Lookup, and Analyst Notes: Search. The serialization parameter controls how much detail is returned for entities in API responses, allowing you to balance between response payload size and information completeness. This is particularly important when working with analyst notes that reference dozens or hundreds of entities — choosing the appropriate serialization level can significantly reduce response sizes.
Serialization levels
| Level | Default | Entity format | Use case |
|---|---|---|---|
"id" | No | Simple string identifier: "KLh6t7" | When you only need entity IDs for subsequent lookups via Entity: Lookup or type-specific lookup endpoints. Minimal bandwidth. |
"min" | No | Object with name only: {"name": "Xtreme RAT"} | When you need human-readable entity names for display without full details. |
"full" | Yes | Complete object: {"id": "KLh6t7", "name": "Xtreme RAT", "type": "Malware", "description": "..."} | When you need complete entity information including RF IDs, names, types, and descriptions. |
The serialization level applies to all entity fields in the response, including note_entities, context_entities, and any nested entity references within analyst note content.