Create a new incident
const url = 'https://api.adversarial.com/api/v1/incidents';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"assigned_to":null,"contained_date":null,"description":"","detected_date":null,"occurred_date":null,"responded_date":null,"severity":null,"severity_reasoning":null,"source":null,"status":null,"tags":null,"title":""}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.adversarial.com/api/v1/incidents \ --header 'Content-Type: application/json' \ --data '{ "assigned_to": null, "contained_date": null, "description": "", "detected_date": null, "occurred_date": null, "responded_date": null, "severity": null, "severity_reasoning": null, "source": null, "status": null, "tags": null, "title": "" }'Request Bodyrequired
Section titled “Request Bodyrequired”The required properties of a request to POST /incidents
object
Existing item tags to link. UUID values resolve only by id; other
values match exact content after trimming. Tags are never created.
Requires tags:read when non-empty.
Responses
Section titled “Responses”Incident created
Register row for an Incident. An Incident plus the relational data shown on
the incident register: risk associations, threat objectives, tags, and comment count.
object
Files attached to this incident, newest-first.
A file attached to a risk, an incident, or a comment on either.
Embedded in the attachments list of the record it is attached to, and
returned when a file is uploaded to a risk or incident.
object
File size in bytes.
MIME content type.
The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.
When the file was uploaded.
The attachment’s id; download it with GET /v1/files/{id}.
Original file name as uploaded.
The file’s upload status. Attachments are only listed once their upload
has finished, so this is always ready.
Relationship, core incident information
object
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
When set, this incident is linked under the named parent incident.
Where the incident was reported from (e.g. “Employee Reported”). Always present.
The status of an incident
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
Number of incidents linked under this incident (i.e. children pointing at it).
An incident is itself a linked child when incident.parent_id is set.
object
A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
Example
{ "attachments": [ { "status": "pending" } ], "incident": { "id": "INC-00001", "parent_id": "INC-00001", "severity": "SEV-5", "status": "New" }, "threat_objectives": [ { "relevance": "Moderate", "threat_objective": "Sabotage" } ]}Validation failed (e.g. unknown source, inactive assignee, unknown tag)
Insufficient permissions