Export incidents as CSV

POST

/v1/incidents/export

const url = 'https://api.adversarial.com/api/v1/incidents/export';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"columns":["id"],"filename":"example","filter":{"assigned_to":null,"child_id":null,"contained_after":null,"contained_before":null,"contained_is_null":null,"created_after":null,"created_before":null,"description_contains":null,"detected_after":null,"detected_before":null,"free_text":null,"id":null,"id_contains":null,"mentioned":null,"occurred_after":null,"occurred_before":null,"occurred_is_null":null,"opened_by":null,"order_by":null,"page":1,"page_size":50,"parent_id":["null"],"responded_after":null,"responded_before":null,"responded_is_null":null,"severity":null,"source":null,"status":null,"tags":null,"threat_objectives":null,"title_contains":null,"updated_after":null,"updated_before":null,"updated_by":null},"selected_incidents":"INC-00001"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.adversarial.com/api/v1/incidents/export \
  --header 'Content-Type: application/json' \
  --data '{ "columns": [ "id" ], "filename": "example", "filter": { "assigned_to": null, "child_id": null, "contained_after": null, "contained_before": null, "contained_is_null": null, "created_after": null, "created_before": null, "description_contains": null, "detected_after": null, "detected_before": null, "free_text": null, "id": null, "id_contains": null, "mentioned": null, "occurred_after": null, "occurred_before": null, "occurred_is_null": null, "opened_by": null, "order_by": null, "page": 1, "page_size": 50, "parent_id": [ "null" ], "responded_after": null, "responded_before": null, "responded_is_null": null, "severity": null, "source": null, "status": null, "tags": null, "threat_objectives": null, "title_contains": null, "updated_after": null, "updated_before": null, "updated_by": null }, "selected_incidents": "INC-00001" }'

Request Body

application/json

One of:

null
object

null

object

columns

Optional list of column keys to include, in order. If None, exports all columns.

Array<string> | null

Allowed values: id title description status severity source created_date updated_date detected_date occurred_date responded_date contained_date assigned_to opened_by severity_reasoning tags

filename

Optional custom filename (without .csv extension)

string | null

filter

One of:

null
object

null

Filter applied in “All in filter” mode. Used when selected_incidents is empty. Pagination on the filter is overridden by streaming defaults.

object

assigned_to

Accepts UUIDs, the literal null (unassigned), and the sentinel me (the calling user, resolved server-side). Multiple values union.

Array | null

unique items

child_id

Filter on what is linked under an incident. Accepts the literal any (incidents with at least one non-deleted child — the “Parent Incidents Only” quick filter), the literal null (incidents with no children), or a child id as INC-<n> or a bare number (that child’s parent). Repeat to union. Omit to leave the filter off.

Because links are single-layer, every parent is top-level, so this composes with the default parent_id=null register view.

Array | null

contained_after

Inclusive lower bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

contained_before

Inclusive upper bound on contained_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

contained_is_null

Match only incidents whose contained_date is unset. Mutually exclusive with contained_after/contained_before.

boolean | null

created_after

Inclusive lower bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

created_before

Inclusive upper bound on created_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

description_contains

string | null

detected_after

Inclusive lower bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

detected_before

Inclusive upper bound on detected_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

free_text

string | null

Return only these incidents. Accepts INC-<n> or a bare number, matching parent_id / child_id and the risk register’s id.

Array<string> | null

id_contains

string | null

mentioned

Incidents with at least one live comment that @-mentions the given user. Accepts UUIDs, the sentinel me (the calling user, resolved server-side), and the literal null (no comment mentions anyone). Multiple values union — e.g. mentioned=me&mentioned=null returns incidents that mention you plus incidents that mention nobody.

Array | null

unique items

occurred_after

Inclusive lower bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

occurred_before

Inclusive upper bound on occurred_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

occurred_is_null

Match only incidents whose occurred_date is unset. Mutually exclusive with occurred_after/occurred_before.

boolean | null

opened_by

Array | null

unique items

order_by

string | null

page

1-indexed page number. Defaults to 1 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 1 >= 1 <= 1000000

page_size

Rows per page. Defaults to 50 (explicit null reads as the default); zero is rejected.

integer format: int64

default: 50 >= 1 <= 500

parent_id

Filter on what an incident is linked under. Accepts the literal null (top-level incidents), the literal any (only incidents linked under a parent), or a parent id as INC-<n> or a bare number. Repeat the parameter to union — ?parent_id=null&parent_id=any is every incident.

Defaults to null, so registers and rollups list top-level records only. An explicit JSON null on the body path reads as that same default, not as “no filter”.

Array | null

default: null

responded_after

Inclusive lower bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

responded_before

Inclusive upper bound on responded_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

responded_is_null

Match only incidents whose responded_date is unset. Mutually exclusive with responded_after/responded_before.

boolean | null

severity

Array | null

unique items

source

Array<string> | null

unique items

status

Array<string> | null

unique items

Allowed values: New In Progress Review Closed

tags

Array | null

unique items

threat_objectives

Array | null

unique items

title_contains

string | null

updated_after

Inclusive lower bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_before

Inclusive upper bound on updated_date. RFC 3339 or bare YYYY-MM-DD.

string | null format: date-time

updated_by

Array | null

unique items

selected_incidents

required

IDs of selected rows. When non-empty, exports only these and ignores filter. When empty, falls back to “All in filter”.

Array<string>

Example

INC-00001

Responses

200

Export all incidents with current state as CSV

application/octet-stream

Array<integer>