Retrieve a single alert by ID, including triage state, triggering rule, and the intelligence hits that activated it.
What this endpoint does
Retrieves a single alert by its short alphanumeric ID (e.g., BFwaQQA). Use this after Alerts: Search to fetch full detail on a specific alert. The optional fields parameter controls which sections are returned as a comma-separated list — omit it to get everything, or specify just what you need (e.g., fields=id,rule,review for lightweight triage data, or fields=hits to get the intelligence matches that triggered the alert). Set taggedText=true to include inline entity markup in text fields.
Response data
Returns the alert's triage state, the rule that fired, and — when requested — the full set of intelligence hits that triggered it. Each hit carries the matched entities, source document reference, and text fragment so an analyst can assess relevance without leaving the API. The review object reflects both the legacy status enum and the portal-facing status, plus any assignee and analyst notes. Use url.portal to deep-link into the Recorded Future portal for the alert, and fetch embedded images via Alerts: Get Image.