---
title: "Bulk Geopolitics Facility alerts lookup"
method: POST
path: "/geopolitics_facility"
tags: ["Geopolitics Facility"]
---

# Bulk Geopolitics Facility alerts lookup

`POST /geopolitics_facility`

Perform a detailed lookup of data panels for several Geopolitics Facility alerts at once.

## Request body

- object
  - `events_limit` integer
  - `playbook_alert_ids` string[], required — The unique ids of the triggered Playbook Alerts
  - `panels` string[] — Request inclusion of detailed facility alert data, grouped into a set of panels. If left unset, all panels will be returned.

## Response `200`

Data for the requested panels.

- object
  - `status` PlaybookAlertStatusResponse
    - `status_code` 'Ok' | 'Error' — Status describing the result of the request.
    - `status_message` string — Text describing the status, suitable for displaying an error.
  - `data` GeopoliticsFacilityResponse[]
    - `playbook_alert_id` string, required
    - `panel_status` FacilityStatusPanel — Data structure containing general information about the alert and it's associated entity.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required — The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert.
      - `assignee_name` string — Full name of the assignee
      - `assignee_id` string — ID of the assignee
      - `created` string, date-time, required — The Creation time of the Playbook Alert
      - `updated` string, date-time, required — The Update time of the Playbook Alert
      - `case_rule_id` string, required — The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field)
      - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' — The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field)
      - `alert_rule` PlaybookAlertAlertRule, required
        - `id` string, required — The Rule ID that created the Playbook Alert (without the 'report:' prefix)
        - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'Undefined', required — The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing.
        - `name` string — The Rule name (if defined) that created the Playbook Alert
      - `creator_name` string — Full name of the Creator of the Playbook Alert
      - `creator_id` string — Id of the Creator of the Playbook Alert
      - `owner_id` string — Id of the owner
      - `owner_name` string — Name of the owner
      - `organisation_id` string — Id of the Organisation
      - `organisation_name` string — Name of the Organisation
      - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails
        - `organisations` PlaybookAlertOrganisation[]
          - `organisation_id` string — Id of the Organisation
          - `organisation_name` string — Name of the Organisation
        - `enterprise_id` string — Id of the Enterprise
        - `enterprise_name` string — Name of the Enterprise
      - `entity_id` string
      - `entity_name` string
      - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity
      - `risk_score` integer — Risk score assigned to the entity
      - `reopen` 'Never' | 'SignificantUpdates' — Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates
      - `targets` FacilityTarget[], required — A list of facilities associated with the exposure.
        - `name` string
      - `actions_taken` OnwardActionId[], required
    - `panel_evidence_summary` FacilitySummaryPanel — Facility Evidence Summary with assessments
      - `events` Event[]
        - `text` string
        - `source` string
        - `url` string
        - `document_id` string
        - `time` string, date-time
        - `images` GeopoliticsFacilityEventImage[]
        - `assessments` FacilityAssessment[]
          - `name` string
          - `criticality` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `assessments` FacilityAssessment[]
        - `name` string
        - `criticality` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
    - `panel_events_summary` FacilityEventsPanel — Facility Evidence Summary with assessments
      - `events` FullEvent[]
        - `translated_text` string
        - `translate_title` string
        - `source` string
        - `url` string
        - `document_id` string
        - `time` string, date-time
        - `images` GeopoliticsFacilityEventImage[]
        - `assessments` FacilityAssessment[]
          - `name` string
          - `criticality` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `assessments` FacilityAssessment[]
        - `name` string
        - `criticality` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
    - `panel_overview` FacilityOverviewPanel — Facility alert overview
      - `event_type` string
      - `location` string
      - `location_distance` LocationDistance — Facility location data
        - `number` number
        - `unit` string
        - `facility_name` string
      - `event_time` string, date-time
      - `source` string
      - `ai_insights` string
      - `most_recent_event` Event — Event of PBA
        - `text` string
        - `source` string
        - `url` string
        - `document_id` string
        - `time` string, date-time
        - `images` GeopoliticsFacilityEventImage[]
        - `assessments` FacilityAssessment[]
          - `name` string
          - `criticality` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `facility_name` string
      - `facility_id` string
      - `location_data` LocationData — Facility location data
        - `latitude` number
        - `longitude` number
        - `radius` integer
      - `watchlist_comment` string
      - `event_document_id` string
      - `is_based_on_deleted_event` boolean — If overview data is based on deleted event it returns datetime of deleted event
      - `deleted_event_time` string — If overview data is based on deleted event it returns datetime of deleted event
    - `panel_log` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates.
      - `id` string
      - `actor_name` string — Full name of the author
      - `actor_id` string — Id of the author
      - `created` string, date-time
      - `modified` string, date-time
      - `action_priority` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `message` string — Log message
      - `changes` PlaybookAlertLogPanelChanges
        - `assignee_change` AssigneeChange
          - `old` string
          - `new` string
          - `type` 'assignee_change', required
        - `status_change` StatusChange — This change applies to any alert type.
          - `old` string, required
          - `new` string, required
          - `type` 'status_change', required
        - `priority_change` PriorityChange — This change applies to any alert type.
          - `old` string, required
          - `new` string, required
          - `type` 'priority_change', required
        - `reopen_strategy_change` ReopenStrategyChange — This change applies to any alert type.
          - `old` string
          - `new` string
          - `type` 'reopen_strategy_change', required
        - `title_change` TitleChange — This change applies to any alert type.
          - `old` string
          - `new` string
          - `type` 'title_change', required
        - `entities_change` EntitiesChange
          - `removed` string[]
          - `added` string[]
          - `type` 'entities_change', required
        - `related_entities_change` RelatedEntitiesChange
          - `removed` string[]
          - `added` string[]
          - `type` 'related_entities_change', required
        - `description_change` DescriptionChange — This change applies to any alert type.
          - `old` string
          - `new` string
          - `type` 'description_change', required
        - `external_id_change` ExternalIdChange — Record of an external ID change on a case.
          - `type` 'external_id_change'
          - `old` string
          - `new` string
        - `actions_change` ActionChange — This change applies to any alert type.
          - `removed` string[], required
          - `added` string[], required
          - `type` 'action_change', required
        - `assessment_ids_change` AssessmentIdsChange — This change applies to any alert type.
          - `removed` string[]
          - `added` string[]
          - `type` 'assessment_ids_change', required
      - `context` union
        - DomainAbuseChangeContext
          - `type` 'domain_abuse', required
          - `changes` union[], required
            - union
              - …
        - VulnerabilityChangeContext
          - `type` 'cyber_vulnerability', required
          - `changes` union[], required
            - union
              - …
        - CodeRepoLeakageChangeContext
          - `type` 'code_repo_leakage', required
          - `changes` union[], required
            - union
              - …
        - ThirdPartyRiskChangeContext
          - `type` 'third_party_risk', required
          - `changes` union[], required
            - union
              - …
        - FacilityRiskChangeContext
          - `type` 'geopolitics_facility', required
          - `changes` union[], required
            - union
              - …
    - `panel_log_v2` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries.
      - `id` string, required
      - `author_id` string — Id of the author
      - `author_name` string — Full name of the author
      - `created` string, date-time, required
      - `changes` union[], required
        - union
          - AssigneeChangeV2 — This change applies to any alert type.
            - `old` Assignee
              - …
            - `new` Assignee
              - …
            - `type` 'assignee_change', required
          - CustomStatusChange — This change applies to any alert type.
            - `old` string, required
            - `new` string, required
            - `type` 'status_change', required
            - `actions_taken` OnwardActionId[], required
          - PriorityChange — This change applies to any alert type.
            - `old` string, required
            - `new` string, required
            - `type` 'priority_change', required
          - ReopenStrategyChange — This change applies to any alert type.
            - `old` string
            - `new` string
            - `type` 'reopen_strategy_change', required
          - TitleChange — This change applies to any alert type.
            - `old` string
            - `new` string
            - `type` 'title_change', required
          - EntitiesChangeV2 — This change applies to any alert type.
            - `removed` Entity[], required
              - …
            - `added` Entity[], required
              - …
            - `type` 'entities_change', required
          - RelatedEntitiesChangeV2 — This change applies to any alert type.
            - `removed` Entity[], required
              - …
            - `added` Entity[], required
              - …
            - `type` 'related_entities_change', required
          - DescriptionChange — This change applies to any alert type.
            - `old` string
            - `new` string
            - `type` 'description_change', required
          - ExternalIdChange — Record of an external ID change on a case.
            - `type` 'external_id_change'
            - `old` string
            - `new` string
          - CommentChange — This change applies to any alert type.
            - `comment` string, required
            - `type` 'comment_change', required
          - ActionChange — This change applies to any alert type.
            - `removed` string[], required
            - `added` string[], required
            - `type` 'action_change', required
          - AssessmentIdsChange — This change applies to any alert type.
            - `removed` string[]
            - `added` string[]
            - `type` 'assessment_ids_change', required
          - CustomOnwardActionsRemovedChange — This change applies to any alert type.
            - `removed_actions_taken` OnwardActionId[]
            - `type` 'onward_actions_removed_change'
          - CustomOnwardActionsAddedChange — This change applies to any alert type.
            - `added_actions_taken` OnwardActionId[]
            - `type` 'onward_actions_added_change'
          - FacilityEvidenceChange
            - `added` FacilityEvidence[], required
              - …
            - `type` 'evidence_changes', required
          - ClusterChangeAdded — Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert.
            - `cluster_id` string
            - `main_event` object
              - …
            - `other_event_ids` string[]
            - `type` 'cluster_change_added', required

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)