Associate a risk with an incident

POST

/v1/incidents/{id}/risks/{risk_id}

const url = 'https://api.adversarial.com/api/v1/incidents/INC-00001/risks/RSK-00001';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.adversarial.com/api/v1/incidents/INC-00001/risks/RSK-00001

Parameters

Path Parameters

required

string

The ID of the incident to associate the risk with — INC-00001 (case-insensitive) or a bare number

Example

INC-00001

risk_id

required

string

The ID of the risk to associate with the incident — RSK-00001 (case-insensitive) or a bare number

Example

RSK-00001

Responses

200

The incident, with the risk associated

application/json

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object

attachments

required

Files attached to this incident, newest-first.

Array<object>

A file attached to a risk, an incident, or a comment on either.

Embedded in the attachments list of the record it is attached to, and returned when a file is uploaded to a risk or incident.

object

byte_size

File size in bytes.

integer | null format: int64

content_type

required

MIME content type.

string

created_by

The user who uploaded the file, if known. On a comment’s attachments this can differ from the comment’s author: a comment may reference a file someone else uploaded to the same record.

string | null format: uuid

created_date

required

When the file was uploaded.

string format: date-time

required

The attachment’s id; download it with GET /v1/files/{id}.

string format: uuid

name

required

Original file name as uploaded.

string

status

required

The file’s upload status. Attachments are only listed once their upload has finished, so this is always ready.

string

Allowed values: pending ready failed

comment_count

required

integer format: int64

incident

required

Relationship, core incident information

object

assigned_to

One of:

object
null

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

contained_date

string | null format: date-time

created_date

required

string format: date-time

description

required

string

detected_date

required

string format: date-time

required

string

occurred_date

string | null format: date-time

opened_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

parent_id

When set, this incident is linked under the named parent incident.

string | null

responded_date

string | null format: date-time

severity

One of:

string
null

string

Allowed values: SEV-5 SEV-4 SEV-3 SEV-2 SEV-1

severity_reasoning

string | null

source

required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string

status

required

The status of an incident

string

Allowed values: New In Progress Review Closed

title

required

string

updated_by

required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object

email

required

string

first_name

required

string

icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null

required

string format: uuid

last_name

required

string

updated_date

required

string format: date-time

linked_children_count

required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64

risk_associations

required

Array<string>

tags

required

Array<object>

object

content

required

string

creator_id

required

string format: uuid

required

string format: uuid

org_id

string | null format: uuid

threat_objectives

required

Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object

created_date

The time that this relation was mutated

string | null format: date-time

relevance

One of:

string
null

How relevant the threat objective is. Responses always carry a relevance. In a request, null removes the objective.

string

Allowed values: Moderate Substantial

threat_objective

required

The threat objective type

string

Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud

Example

{
  "attachments": [
    {
      "status": "pending"
    }
  ],
  "incident": {
    "id": "INC-00001",
    "parent_id": "INC-00001",
    "severity": "SEV-5",
    "status": "New"
  },
  "threat_objectives": [
    {
      "relevance": "Moderate",
      "threat_objective": "Sabotage"
    }
  ]
}

404

Incident or risk not found

409

Risk is already associated with the incident