What this endpoint does

Retrieves detailed third-party risk intelligence for multiple alerts in a single request (up to 250 alert IDs). Each alert monitors a third-party vendor or company for cyber risk changes — such as reported cyber attacks, security incidents, data breaches, or significant increases in threat references. Use the Playbook Alerts: Search endpoint with category third_party_risk to discover alert IDs. The optional panels parameter lets you request only specific data sections ("status", "summary", or "log") to reduce response size. For single-alert retrieval, use the Playbook Alerts: Third Party Risk Detail endpoint.

Response data

Each alert contains panel-organized data: panel_status provides the monitored entity (company name, entity ID, criticality rating, and Recorded Future risk score), the triggering alert rule, and alert metadata; panel_evidence_summary contains an array of assessments, each identifying a triggered risk rule (e.g., "Recent Reported Cyber Attack", "Cyber Trends") with a severity level, evidence summary text with source links, and metadata including a description of the risk and recommended actions to consider; panel_log tracks the chronological history of risk assessment changes — when risk rules were triggered or cleared, evidence reference counts, and priority changes over time.