Export incidents as CSV
const url = 'https://api.adversarial.com/api/v1/incidents/export';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"columns":["id"],"filename":"example","filter":{"assigned_to":null,"child_id":null,"contained_after":null,"contained_before":null,"contained_is_null":null,"created_after":null,"created_before":null,"description_contains":null,"detected_after":null,"detected_before":null,"free_text":null,"id":null,"id_contains":null,"installation_id":null,"mentioned":null,"occurred_after":null,"occurred_before":null,"occurred_is_null":null,"opened_by":null,"order_by":null,"page":1,"page_size":50,"parent_id":["null"],"responded_after":null,"responded_before":null,"responded_is_null":null,"severity":null,"source":null,"status":null,"tags":null,"threat_objectives":null,"title_contains":null,"updated_after":null,"updated_before":null,"updated_by":null},"selected_incidents":"INC-00001"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.adversarial.com/api/v1/incidents/export \ --header 'Content-Type: application/json' \ --data '{ "columns": [ "id" ], "filename": "example", "filter": { "assigned_to": null, "child_id": null, "contained_after": null, "contained_before": null, "contained_is_null": null, "created_after": null, "created_before": null, "description_contains": null, "detected_after": null, "detected_before": null, "free_text": null, "id": null, "id_contains": null, "installation_id": null, "mentioned": null, "occurred_after": null, "occurred_before": null, "occurred_is_null": null, "opened_by": null, "order_by": null, "page": 1, "page_size": 50, "parent_id": [ "null" ], "responded_after": null, "responded_before": null, "responded_is_null": null, "severity": null, "source": null, "status": null, "tags": null, "threat_objectives": null, "title_contains": null, "updated_after": null, "updated_before": null, "updated_by": null }, "selected_incidents": "INC-00001" }'Request Body
Section titled “Request Body”object
Optional list of column keys to include, in order. If None, exports all columns.
Optional custom filename (without .csv extension)
Filter applied in “All in filter” mode. Used when selected_incidents
is empty. Pagination on the filter is overridden by streaming defaults.
object
Accepts UUIDs, the literal null (unassigned), and the sentinel
me (the calling user, resolved server-side). Multiple values
union.
Filter on what is linked under an incident. Accepts the literal any
(incidents with at least one non-deleted child — the “Parent Incidents
Only” quick filter), the literal null (incidents with no children), or
a child id as INC-<n> or a bare number (that child’s parent). Repeat
to union. Omit to leave the filter off.
Because links are single-layer, every parent is top-level, so this
composes with the default parent_id=null register view.
Match only incidents whose contained_date is unset. Mutually
exclusive with contained_after/contained_before.
Return only these incidents. Accepts INC-<n> or a bare number,
matching parent_id / child_id and the risk register’s id.
Keep only records that the given integration installations imported. Multiple values union.
Incidents with at least one live comment that @-mentions the given
user. Accepts UUIDs, the sentinel me (the calling user, resolved
server-side), and the literal null (no comment mentions anyone).
Multiple values union — e.g. mentioned=me&mentioned=null returns
incidents that mention you plus incidents that mention nobody.
Match only incidents whose occurred_date is unset. Mutually
exclusive with occurred_after/occurred_before.
1-indexed page number. Defaults to 1 (explicit null reads as the
default); zero is rejected.
Rows per page. Defaults to 50 (explicit null reads as the default);
zero is rejected.
Filter on what an incident is linked under. Accepts the literal
null (top-level incidents), the literal any (only incidents linked
under a parent), or a parent id as INC-<n> or a bare number. Repeat
the parameter to union — ?parent_id=null&parent_id=any is every
incident.
Defaults to null, so registers and rollups list top-level records
only. An explicit JSON null on the body path reads as that same
default, not as “no filter”.
Match only incidents whose responded_date is unset. Mutually
exclusive with responded_after/responded_before.
IDs of selected rows. When non-empty, exports only these and ignores
filter. When empty, falls back to “All in filter”.
Example
INC-00001Responses
Section titled “Responses”Export all incidents with current state as CSV