---
title: "Lookup a specific Analyst Note"
method: POST
path: "/lookup/{note_id}"
tags: ["Analyst Note"]
---

# Lookup a specific Analyst Note

`POST /lookup/{note_id}`

Retrieve a specific analyst note by its ID with configurable serialization level.

## Path parameters

- `note_id` string, required

## Request body

- LookupRequest
  - `tagged_text` boolean — Determines if the `<entity></entity>` tags should be inline with entities in the note title and text.
  - `escape_html` boolean — Determines if HTML tags are escaped, applied only when `tagged_text = true`.
  - `serialization` 'id' | 'min' | 'full' — Entity serialization level. When set to `id`, only the entity id will be included. Setting it to `min` leads to the id and name being included and setting it to `full` means that each entity will have the id, name, type and possibly a description included in the response.

## Response `200`

Detailed object of the note.

- LookupResponse
  - `identities` LeakedIdentity[], required
    - `identity` IdentityDetails, required
      - `subjects` string[], required
    - `count` integer, required
    - `credentials` Credentials[], required
      - `subject` string, required
      - `authorization_service` AuthorizationService
        - `url` string, required
        - `domain` string, required
        - `fqdn` string, required
        - `protocols` string[], required
        - `technology` Technology[], required
          - `id` string
          - `name` string, required
          - `category` string
      - `authorization_services` AuthorizationService[], required
        - `url` string, required
        - `domain` string, required
        - `fqdn` string, required
        - `protocols` string[], required
        - `technology` Technology[], required
          - `id` string
          - `name` string, required
          - `category` string
      - `exposed_secret` SecretDetails, required
        - `type` string, required
        - `effectively_clear` boolean, required
        - `hashes` PasswordHash[], required
          - union
            - FullPasswordHash
              - …
            - PrefixPasswordHash
              - …
        - `details` CleartextPasswordDetails
          - `clear_text_value` string
          - `clear_text_hint` string
          - `properties` PasswordProperty[], required
      - `compromise` DeprecatedCompromise
        - `exfiltration_date` string, date-time, required
      - `cookies` Cookie[], required
        - `dns` string, required
        - `name` string, required
        - `http` boolean, required
        - `expiration` string, date-time, required
        - `secure` boolean, required
        - `value` string
      - `malware_family` MalwareFamily
        - `id` string, required
        - `name` string, required
      - `dumps` DumpMetadata[], required
        - `name` string, required
        - `type` string
        - `source` string, required
        - `description` string
        - `infrastructure` Infrastructure
          - `ip` string, required
        - `compromise` Compromise
          - `os` string
          - `os_username` string
          - `malware_file` string
          - `timezone` string
          - `computer_name` string
          - `uac` string
          - `antivirus` string[]
          - `exfiltration_date` string, date-time, required
        - `location` Location
          - `country` CountryCode
            - `name` string, required
            - `displayName` string, required
            - `countryCode` string, required
            - `alpha2Code` string, required
            - `alpha3Code` string, required
          - `city` string
          - `address` string
          - `address1` string
          - `address2` string
          - `state` string
          - `postal_code` string
          - `zip` string
        - `breaches` BreachMetadata[], required
          - `name` string, required
          - `domain` string, required
          - `type` string, required
          - `breached` string, date-time
          - `start` string, date-time
          - `stop` string, date-time
          - `precision` 'YEAR' | 'MONTH' | 'DAY'
          - `description` string, required
          - `site_description` string
        - `downloaded` string, date-time, required
      - `first_downloaded` string, date-time, required
      - `latest_downloaded` string, date-time, required
      - `source_type` 'MalwareLogs' | 'DatabaseDumps' | 'MalwareCombolists' | 'DatabaseCombolists'
  - `count` integer, required
  - `next_offset` string

## Other responses

- `404` — Resource not found

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)