What this endpoint does

Retrieves detailed information for a single Third Party Risk alert, identified by its alert ID in the URL path. These alerts track monitored third-party vendors and companies for cyber risk changes — such as reported cyber attacks, security incidents, data breaches, or significant increases in threat references. Use the Playbook Alerts: Search endpoint with category third_party_risk to discover alert IDs. The optional panels body parameter lets you request specific data sections ("status", "summary", or "log") to reduce response size. For retrieving multiple alerts at once, use the Playbook Alerts: Third Party Risk Bulk endpoint.

Response data

The response contains a single alert with panel-organized data: panel_status provides the monitored entity (company name, entity ID, criticality rating, and Recorded Future risk score), the triggering alert rule, and alert metadata; panel_evidence_summary contains an array of assessments, each identifying a triggered risk rule (e.g., "Recent Reported Cyber Attack", "Cyber Trends") with a severity level, evidence summary text with source links, and metadata including a description of the risk and recommended actions; panel_log tracks the chronological history of risk assessment changes, including when risk rules were triggered or cleared, evidence reference counts, and priority changes over time.