Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's value. Only Playbook Alerts matching all specified criteria are included in the response.
What this endpoint does
The primary entry point for all Playbook Alerts workflows. Search with optional filters to retrieve alert summaries — the playbook_alert_id from each result is the key identifier for all downstream endpoints. After searching, call the category-specific bulk or detail endpoint for full evidence:
domain_abuse→ Domain Abuse Bulk / Detailcyber_vulnerability→ Vulnerability Bulk / Detailidentity_novel_exposures→ Identity Exposures Bulk / Detailmalware_report→ Malware Report Bulk / Detail
All filters are optional (AND logic). Valid filter values from Playbook Alerts: Metadata. Use offset (not the deprecated from) for pagination.
Response data
Returns alert summaries only — no evidence panels. Iterate response.data (an array, not response.data.results). Each object carries the playbook_alert_id, status, priority, category, title, timestamps, and assignee. Paginated via next_offset.