Create a new RSK.
const url = 'https://api.adversarial.com/api/v1/risks';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"assigned_to_id":null,"closed_date":null,"control_statement":null,"description":"","discovered_date":null,"due_date":null,"expected_date":null,"impact":null,"impact_reasoning":null,"initially_reported_urgency":null,"likelihood":null,"likelihood_reasoning":null,"remediation_task":null,"source":null,"status":null,"tags":null,"threat_objectives":null,"title":"","type":null}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.adversarial.com/api/v1/risks \ --header 'Content-Type: application/json' \ --data '{ "assigned_to_id": null, "closed_date": null, "control_statement": null, "description": "", "discovered_date": null, "due_date": null, "expected_date": null, "impact": null, "impact_reasoning": null, "initially_reported_urgency": null, "likelihood": null, "likelihood_reasoning": null, "remediation_task": null, "source": null, "status": null, "tags": null, "threat_objectives": null, "title": "", "type": null }'Request Bodyrequired
Section titled “Request Bodyrequired”The required properties of a request to POST /risks
object
Existing item tags to link. UUID values resolve only by id; other
values match exact content after trimming. Tags are never created.
Requires tags:read when non-empty.
A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
Responses
Section titled “Responses”Risk created successfully
Register row for Organization Risks (RSKs). A Risk plus the relational data
shown on the risk register: threat objectives, incident associations, tags, and
comment count.
object
Files attached to this risk, newest-first.
A file attached to a risk, an incident, or a comment on either.
Embedded in the attachments list of the record it is attached to, and
returned when a file is uploaded to a risk or incident.
object
File size in bytes.
MIME content type.
The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.
When the file was uploaded.
The attachment’s id; download it with GET /v1/files/{id}.
Original file name as uploaded.
The file’s upload status. Attachments are only listed once their upload
has finished, so this is always ready.
Count of comments on this risk (not the comments themselves).
Number of risks linked under this risk (i.e. children pointing at it).
A risk is itself a linked child when risk.parent_id is set.
The core view of an Organization Risk (RSK).
Relational data — threat objectives, comments, incident associations, and tags —
is exposed on RiskRegisterEntry, not here.
object
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
When set, this risk is linked under the named parent risk.
The status of a risk
A User as returned by the API.
Profile images are not embedded — clients fetch them from
GET /api/v1/{icon} when icon is Some.
object
Relative path to the user’s avatar endpoint, e.g.
"users/{id}/avatar?v={hash}". None when the user has no avatar.
object
A threat objective paired with how relevant it is to a risk.
Two relations are considered the same when the objective and its relevance
match; created_date records when the relation was last changed and is not
part of its identity.
Example
{ "attachments": [ { "status": "pending" } ], "incident_associations": "INC-00001", "risk": { "id": "RSK-00001", "impact": "Very Low", "initially_reported_urgency": "Critical", "likelihood": "Remote", "parent_id": "RSK-00001", "status": "New", "type": "Code", "urgency": "Info" }, "threat_objectives": [ { "relevance": "Moderate", "threat_objective": "Sabotage" } ]}Validation failed (e.g. unknown source, inactive assignee, unknown tag)
Insufficient permissions