---
title: "Fetch alert by id"
method: GET
path: "/v3/{alert_id}"
tags: ["Alert V3"]
---

# Fetch alert by id

`GET /v3/{alert_id}`

Retrieve a single alert by ID, including triage state, triggering rule, and the intelligence hits that activated it.

## Path parameters

- `alert_id` string, required

## Query parameters

- `fields` string
- `taggedText` boolean

## Response `200`

output

- AlertLookupResponseV3 — Single alert lookup response with full detail including hits, rule info, and review status.
  - `data` object, required — An alert notification with intelligence hits.
    - `id` string — Short alphanumeric alert identifier
    - `rule` object — The alerting rule that generated this alert.
      - `name` string — Rule display name
      - `id` string — Rule identifier
      - `url` object — URLs to access this rule.
        - `portal` string — URL to the rule in the Recorded Future portal
    - `review` object — Triage/review metadata for the alert.
      - `status` 'unassigned' | 'assigned' | 'pending' | 'dismiss' | 'no-action' | 'actionable' | 'tuning' — Legacy alert status
      - `status_in_portal` 'New' | 'Resolved' | 'Pending' | 'Dismissed' | 'Flag for Tuning' — Current alert status as shown in the portal
      - `assignee` string, nullable — Assigned user ID or null if unassigned
      - `note` string, nullable — Reviewer note text or null
    - `url` object — URLs to access this alert.
      - `api` string — Direct API URL for this alert
      - `portal` string — URL to view this alert in the Recorded Future portal
    - `owner_organisation_details` object — Organization ownership details.
      - `organisations` object[]
      - `enterprise_id` string, nullable
      - `enterprise_name` string, nullable
    - `hits` object[] — Intelligence hits (reference matches) that triggered this alert.
      - `id` string — Unique hit identifier
      - `entities` object[] — Entities mentioned in this hit (malware, domains, IPs, MITRE ATT&CK IDs, etc.).
        - `id` string — Recorded Future entity ID
        - `name` string — Human-readable entity name
        - `type` string — Entity type (e.g., Malware, InternetDomainName, IpAddress, Hash, Company, MitreAttackIdentifier)
      - `document` object — Source document for this intelligence hit.
        - `source` object — Intelligence source reference.
          - `id` string — Source ID (e.g., source:ndy5_2)
          - `name` string — Source name
          - `type` string — Always 'Source'
        - `title` string — Document title
        - `url` string — URL to the original document
        - `authors` string[] — Document authors.
      - `fragment` string — Text snippet summarizing the intelligence match
      - `language` string — Document language code (e.g., eng)
      - `primary_entity` object, nullable — A Recorded Future entity reference.
        - `id` string — Recorded Future entity ID
        - `name` string — Human-readable entity name
        - `type` string — Entity type (e.g., Malware, InternetDomainName, IpAddress, Hash, Company, MitreAttackIdentifier)
      - `analyst_note` object, nullable — Associated analyst note, or null.
    - `triggered_by` object[] — Entity path chains showing which entities matched which rules/lists.
      - `reference_id` string — Reference hit ID
      - `entity_paths` array[] — Entity chain paths.
        - object[]
          - `attribute` object
            - `id` string
          - `entity` object — A Recorded Future entity reference.
            - `id` string — Recorded Future entity ID
            - `name` string — Human-readable entity name
            - `type` string — Entity type (e.g., Malware, InternetDomainName, IpAddress, Hash, Company, MitreAttackIdentifier)
    - `ai_insights` object — AI-generated insights for this alert (when requested via fields parameter).
    - `title` string — Alert title
    - `type` string — Alert type classification

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)