---
title: "Draft an Analyst Note"
method: POST
path: "/draft"
tags: ["Analyst Note"]
---

# Draft an Analyst Note

`POST /draft`

Create a draft analyst note in the database without publishing it.

## Request body

- DraftRequest
  - `attributes` union, required
    - object
      - `title` string, required
      - `text` string, required
      - `note_entities` string[], required — Entity ids. Either Note entities or context entities must be specified. Each entity must exist as a note entity.
      - `context_entities` string[] — Entity ids. Context entities or note entities must be specified. Each entity must exist as a note entity.
      - `topic` string[] — Array of entity ids for the topics, see [list](https://docs.recordedfuture.com/reference/analyst-note-available-topics) of available ones for details.
      - `labels` string[]
      - `validation_urls` string[]
      - `validated_on` string, date-time — Date when analyst note was validated
      - `detection_rules` string[]
      - `recommended_queries_obj` RecommendedQueryReq[]
        - `title` string, required
        - `url` string, required — Entity id
    - object
      - `title` string, required
      - `text` string, required
      - `note_entities` string[] — Entity ids. Either Note entities or context entities must be specified. Each entity must exist as a note entity.
      - `context_entities` string[], required — Entity ids. Context entities or note entities must be specified. Each entity must exist as a note entity.
      - `topic` string[] — Array of entity ids for the topics, see [list](https://docs.recordedfuture.com/reference/analyst-note-available-topics) of available ones for details.
      - `labels` string[]
      - `validation_urls` string[]
      - `validated_on` string, date-time — Date when analyst note was validated
      - `detection_rules` string[]
      - `recommended_queries_obj` RecommendedQueryReq[]
        - `title` string, required
        - `url` string, required — Entity id
    - object
      - `title` string, required
      - `text` string, required
      - `note_entities` string[], required — Entity ids. Either Note entities or context entities must be specified. Each entity must exist as a note entity.
      - `context_entities` string[], required — Entity ids. Context entities or note entities must be specified. Each entity must exist as a note entity.
      - `topic` string[] — Array of entity ids for the topics, see [list](https://docs.recordedfuture.com/reference/analyst-note-available-topics) of available ones for details.
      - `labels` string[]
      - `validation_urls` string[]
      - `validated_on` string, date-time — Date when analyst note was validated
      - `detection_rules` string[]
      - `recommended_queries_obj` RecommendedQueryReq[]
        - `title` string, required
        - `url` string, required — Entity id
  - `events` union[]
    - union
      - CyberAttackEvent
        - `type` 'CyberAttack', required
        - `attributes` CyberAttackEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `adversary` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `target` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `capabilities` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `malicious_infrastructure` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `operation` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
      - ArmedConflictEvent
        - `type` 'ArmedConflict', required
        - `attributes` ArmedConflictEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `attacker` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `target` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `location` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - ArmsPurchaseSaleEvent
        - `type` 'ArmsPurchaseSale', required
        - `attributes` ArmsPurchaseSaleEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `arms_seller` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `arms_purchaser` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
      - CoupEvent
        - `type` 'Coup', required
        - `attributes` CoupEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `location` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - DiseaseOutbreakEvent
        - `type` 'DiseaseOutbreak', required
        - `attributes` DiseaseOutbreakEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `disease` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `facility` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `location` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - ElectionEvent
        - `type` 'Election', required
        - `attributes` ElectionEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - EnvironmentalIssueEvent
        - `type` 'EnvironmentalIssue', required
        - `attributes` EnvironmentalIssueEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `environmental_issue` string[], required
          - `location` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - ManMadeDisasterEvent
        - `type` 'ManMadeDisaster', required
        - `attributes` ManMadeDisasterEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `facility` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `manmade_disaster` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - MilitaryManeuverEvent
        - `type` 'MilitaryManeuver', required
        - `attributes` MilitaryManeuverEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `actors` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `locations` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - NaturalDisasterEvent
        - `type` 'NaturalDisaster', required
        - `attributes` NaturalDisasterEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `natural_disaster` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - NuclearMaterialTransactionEvent
        - `type` 'NuclearMaterialTransaction', required
        - `attributes` NuclearMaterialTransactionEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `material` string[], required
          - `location_origin` string[]
          - `location_destination` string[]
      - PersonThreatEvent
        - `type` 'PersonThreat', required
        - `attributes` PersonThreatEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `threatened` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `actor` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
      - PoliticalEvent
        - `type` 'PoliticalEvent', required
        - `attributes` PoliticalEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - RFEVEProtestEvent
        - `type` 'RFEVEProtest', required
        - `attributes` RFEVEProtestEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `protest_target` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `location` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - PublicSafetyWarningEvent
        - `type` 'PublicSafetyWarning', required
        - `attributes` PublicSafetyWarningEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - TerrorIncidentEvent
        - `type` 'TerrorIncident', required
        - `attributes` TerrorIncidentEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `locations` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - RFEVEArmedAssaultEvent
        - `type` 'RFEVEArmedAssault', required
        - `attributes` RFEVEArmedAssaultEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `location` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `event_positions` Position[]
            - `longitude` number, required
            - `latitude` number, required
      - MalwareAnalysisEvent
        - `type` 'MalwareAnalysis', required
        - `attributes` MalwareAnalysisEventAttributes, required
          - `start` string, date-time, required
          - `stop` string, date-time, required
          - `malware` NoteEntity[], required
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `attacker` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `malicious_infrastructure` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `ttp` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `target` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `exploit` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
          - `hash` NoteEntity[]
            - `id` string, required
            - `name` string
            - `type` string
            - `description` string
  - `source` string, uuid, required — Identity of the source
  - `report_id` string — Report identity of analyst note, that is not published yet.
  - `resolve_entities` boolean — Determines if the entity resolver should be used on the note title and text for automated tagging of entities.

## Response `200`

Report id of the draft note.

- DraftResponse
  - `report_id` string, required

## Other responses

- `400` — Invalid request

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)