What this endpoint does

Retrieves detailed fraud intelligence for a single compromised bank check alert, identified by its alert ID in the URL path. These alerts are generated when images of compromised bank checks are discovered on dark web channels such as Telegram. Use the Playbook Alerts: Search endpoint with category fraud_compromised_checks to find alert IDs. The optional panels body parameter lets you request only specific data sections ("status", "summary", or "log") to reduce response size. For retrieving multiple alerts at once, use the Playbook Alerts: Bank Checks Bulk endpoint instead.

Response data

The response contains a single alert with panel-organized data: panel_status provides alert metadata (status, priority, assignee, timestamps, and available remediation actions); panel_evidence_summary contains extracted check details including check amount, check number, routing number, bank name, payer and payee identities with addresses, the dark web source and actor information, collection and posting dates, and assessments indicating whether this is a first appearance or was previously seen; and panel_log_v2 tracks the alert's change history.